Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial number: AV26-042 Date: January 21, 2026 Updated: August 24, 2026 On January 20, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Update 1 On January 21, 2026, a proof of concept (PoC) for the vulnerability CVE-2026-21962 became publicly available. CVE-2026-21962 is a vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware which may allow a remote attacker to obtain unauthorized access. Update 2 On August 24, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates. Oracle Critical Patch Update Advisory – January 2026 CISA KEV: CVE-2026-21962
CSIRTS triage
- What
- Improper access control in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in allows unauthorized creation, deletion, modification, or complete access to critical data.
- Who is affected
- All users running affected Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in deployments.
- Urgency
- Critical — actively exploited as of August 24, 2026 and added to CISA KEV catalog; federal agencies required to prioritize remediation.
- Action
- Apply Oracle's January 2026 Critical Patch Update immediately or consult Oracle's advisory for specific patched versions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
Get an email when a new Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/oracle-security-advisory-january-2026-quarterly-rollup-av26-042
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-21962Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-21962 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploited[UPDATE] [critical] Oracle Fusion Middleware: Multiple Vulnerabilitiescert-bund
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- criticalexploitedCVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerabil…cisa-kev
More from Canadian Centre for Cyber Security
- unknownWatchGuard security advisory (AV26-847)2026-08-25
- unknownOpenSSL security advisory (AV26-846)2026-08-25
- unknownGitea security advisory (AV26-845)2026-08-25
- unknownGoogle security advisory (AV26-844)2026-08-24
- unknownDell security advisory (AV26-843)2026-08-24