CVE-2026-21962: Oracle WebLogic & HTTP Server Actively Exploited — Detection and Remediation Guide

On Monday, CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in the IR community suspected the moment the advisory dropped: this one is being weaponized in the wild. The flaw carries a CVSS score of 10.0 — the maximum — and impacts both Oracle HTTP Server (OHS) and Oracle WebLogic Server. An unauthenticated attacker with nothing more than network access over HTTP can exploit it to access critical data.

If you run WebLogic anywhere near a network boundary, this is a drop-everything event. WebLogic has a long, painful history as a favorite target of ransomware operators, cryptominers, and state-sponsored actors precisely because of vulnerabilities exactly like this one: remotely exploitable, no authentication required, no user interaction needed. A CVSS 10.0 on an internet-facing middleware platform with confirmed active exploitation is about as bad as it gets.

Federal civilian agencies are now under a binding CISA remediation deadline. Every private-sector organization should treat that deadline as their own.

Technical Analysis

What We Know

• CVE ID: CVE-2026-21962
• CVSS v3.1 Score: 10.0 (Critical)
• Affected products: Oracle HTTP Server and Oracle WebLogic Server (Oracle Fusion Middleware stack)
• Attack vector: Network (HTTP)
• Authentication required: None
• User interaction required: None
• Impact: Unauthorized access to critical data — with a 10.0 score, defenders should assume full confidentiality, integrity, and availability impact until Oracle's advisory states otherwise
• Exploitation status: Confirmed active exploitation — listed in the CISA KEV catalog as of this week

Why This Vulnerability Class Is So Dangerous

The attack chain here is brutally simple, which is exactly what makes it attractive to threat actors:

1. Reconnaissance: Attackers scan for exposed Oracle HTTP Server listeners (commonly TCP 7777, 7001, 7002, 8001) or WebLogic consoles reachable over HTTP/HTTPS. Tools like Shodan and Censys make enumerating these targets trivial.
2. Exploitation: A single crafted HTTP request — no credentials, no session, no prior foothold — reaches the vulnerable component. Because OHS frequently fronts WebLogic deployments as a reverse proxy, compromising the HTTP tier often means a direct path into the application server tier and the data behind it.
3. Post-exploitation: Historical WebLogic exploitation campaigns (and defenders should plan for the same here) follow a predictable pattern: the attacker leverages the Java process context to spawn child shells, download second-stage payloads via curl/wget/certutil/PowerShell, establish persistence, and pivot to internal systems. WebLogic servers are typically high-value, credentialed, and well-connected inside the data center.

The key defensive takeaway: the exploit arrives as an HTTP request, but the observable evidence appears in what the WebLogic/OHS process does next. That is where your detection engineering should concentrate.

Exploitation Status

This is not theoretical. CISA KEV inclusion requires validated evidence of active exploitation. When CISA adds a CVSS 10.0 unauthenticated flaw in a ubiquitous enterprise platform, assume scanning and exploitation attempts against your exposed instances are already happening — likely automated, likely at scale, and likely originating from both opportunistic actors and more sophisticated operators harvesting access for later use.

Detection & Response

The following detections focus on the two most reliable observables: (1) the WebLogic/OHS Java process exhibiting post-exploitation behavior (spawning shells, scripting interpreters, downloaders), and (2) suspicious inbound HTTP patterns against the web tier.

Sigma Rules

---
title: Oracle WebLogic or HTTP Server Process Spawning Shell or Downloader
id: 8f2c4a91-3b7d-4e56-a9c1-2d5e7f0a1b2c
status: experimental
description: Detects the Oracle WebLogic Server (java.exe/java) or Oracle HTTP Server (httpd/ohs) process spawning command shells, scripting engines, or download utilities — a hallmark of post-exploitation activity following remote exploitation of WebLogic/OHS vulnerabilities such as CVE-2026-21962.
references:
  - https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\oracle\'
      - '\wlserver\'
      - '\middleware\'
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\httpd.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare cases of WebLogic-deployed applications legitimately invoking system commands; baseline per server and tune by application name
level: high
---
title: Linux Java or HTTPD Process Spawning Shell - WebLogic OHS Post-Exploitation
id: 4a1d8e63-9c2f-4b87-b3d4-6e0f2a5c8d1e
status: experimental
description: Detects java or httpd.worker (Oracle HTTP Server) processes on Linux spawning interactive shells or download tools, consistent with exploitation of Oracle WebLogic Server / Oracle HTTP Server vulnerabilities such as CVE-2026-21962.
references:
  - https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/httpd'
      - '/httpd.worker'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/chmod'
      - '/crontab'
  condition: selection_parent and selection_child
falsepositives:
  - Custom WebLogic applications invoking shell scripts for legitimate business logic; correlate with recent inbound HTTP anomalies before dismissing
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for WebLogic/OHS processes exhibiting post-exploitation behavior, and joins against inbound web-tier connection data for context. Run it across your middleware estate immediately, then convert it into an analytics rule.

// Hunt 1: WebLogic/OHS (java.exe) spawning suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","wmic.exe","net.exe","curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","httpd.exe")
   or InitiatingProcessCommandLine has_any ("weblogic","wlserver","ohs","oracle")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;

// Hunt 2: Inbound connections to common Oracle WebLogic/OHS ports from external sources (via firewall/CEF ingestion)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (7001, 7002, 8001, 7777, 8888, 9443)
| where DeviceAction !in ("deny","drop","blocked")
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP)
    by DestinationIP, DestinationPort, SourceIP, bin(TimeGenerated, 1h)
| where DistinctSources > 50 or ConnectionCount > 500  // scanning behavior
| order by ConnectionCount desc;

Velociraptor VQL

Use this artifact to triage a suspected WebLogic/OHS host — enumerate java/httpd processes, their command lines (which reveal the WebLogic install path and domain), and their live network connections.

-- Triage WebLogic / Oracle HTTP Server hosts for compromise indicators
-- Identifies running java/httpd processes tied to WebLogic and their network activity
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)weblogic|wlserver|ohs|oracle|httpd'
   OR Name =~ '(?i)^(java|javaw|httpd)'

-- Correlate: active outbound connections from those processes
SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)java|httpd'
  AND Status =~ 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

Remediation / Verification Script

Run this on Linux WebLogic/OHS hosts to inventory installations, capture the running version, and flag exposure. Patching itself must be done through Oracle's official channels (see Remediation below), but this gives you the visibility to know exactly what you're working with.

#!/bin/bash
# CVE-2026-21962 triage: inventory WebLogic/OHS instances and exposure
# Run as root or with sudo on suspected middleware hosts

echo "=== [1] Running WebLogic / OHS processes ==="
ps aux | grep -Ei 'weblogic|wlserver|ohs|httpd|java' | grep -v grep

echo "=== [2] Listening ports on common WebLogic/OHS ports ==="
ss -tlnp 2>/dev/null | grep -E ':(7001|7002|8001|7777|8888|9443)\b' || \
  netstat -tlnp 2>/dev/null | grep -E ':(7001|7002|8001|7777|8888|9443)\b'

echo "=== [3] WebLogic registry / version inventory ==="
find /u01 /opt /app /home -maxdepth 6 -name 'registry.xml' -path '*oracle*' 2>/dev/null | while read -r f; do
  echo "--- $f ---"
  grep -E 'name="(WebLogic Server|Oracle HTTP Server)"|version=' "$f" | head -20
done

echo "=== [4] Recent suspicious child processes of java/httpd (last 24h audit log) ==="
ausearch -ts recent -k exec 2>/dev/null | grep -E 'sh|bash|curl|wget|python|nc' | tail -50 || \
  echo "auditd not configured - enable execve auditing: auditctl -a always,exit -F arch=b64 -S execve -k exec"

echo "=== [5] Unexpected outbound connections from java/httpd ==="
ss -tnp 2>/dev/null | grep -Ei 'java|httpd' | grep ESTAB

echo "=== Triage complete. Compare version output against Oracle Critical Patch Update for CVE-2026-21962. ==="

Remediation

Act in this order. Do not wait for a maintenance window if the instance is internet-reachable.

1. Patch immediately. Apply the Oracle Critical Patch Update (CPU) addressing CVE-2026-21962 to every affected Oracle HTTP Server and WebLogic Server instance. Pull the exact patched version numbers and installation instructions directly from Oracle's security advisory at https://www.oracle.com/security-alerts/ — verify your Fusion Middleware base version and apply the corresponding patch via OPatch. Test in staging if you must, but internet-facing systems go first.
2. Meet the CISA KEV deadline. Federal civilian executive branch agencies must remediate per the Binding Operational Directive deadline attached to the KEV entry (typically within days for actively exploited criticals — check the KEV catalog entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Private organizations should hold themselves to the same clock.
3. If you cannot patch today, isolate. Block external access to WebLogic/OHS listeners at the perimeter firewall and WAF. Ports 7001/7002 (WebLogic admin and managed servers) and 7777 (OHS default) should never be internet-exposed — if they are, that is a finding independent of this CVE.
4. Restrict the admin console. Ensure the WebLogic Administration Console is bound to a management network only, protected by network ACLs, and never reachable from user or internet segments.
5. Hunt before you patch. Patching does not evict an attacker. Given confirmed in-the-wild exploitation, assume any unpatched, exposed instance may already be compromised. Run the KQL queries, Sigma rules, and VQL triage above; review HTTP access logs on OHS (access_log) for anomalous requests in the days preceding patch; check for new files in WebLogic deployment directories, unexpected cron entries, and new local accounts.
6. Rotate credentials on any suspect host. WebLogic service accounts, datasource credentials, and any secrets stored in the domain configuration should be treated as exposed if compromise is suspected.
7. Add detection coverage permanently. Deploy the Sigma rules above to your SIEM and enable execve auditing (auditd) on all middleware hosts — the "java spawns a shell" signal is one of the highest-fidelity web-tier compromise indicators you can own, and it will serve you well beyond this CVE.

Bottom Line

CVE-2026-21962 is the nightmare scenario for middleware defense: unauthenticated, network-exploitable, maximum severity, and confirmed exploited. WebLogic's track record tells us exploitation will scale rapidly — automated scanners first, ransomware and access brokers close behind. Patch your Oracle HTTP Server and WebLogic instances now, hunt for compromise that may predate the patch, and fix the exposure hygiene that let these services face untrusted networks in the first place.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub