A critical Oracle middleware vulnerability exploited by a China-linked threat actor in attacks spanning more than 100 countries has prompted the U.S. Cybersecurity and Infrastructure Security Agency to impose an emergency three-day remediation deadline on federal agencies. CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on Aug. 24, requiring affected federal systems to be remediated by Aug. 27.
The vulnerability carries the maximum CVSS score of 10.0 and affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, according to Oracle and security research cited in the supplied reports. Oracle patched the flaw in its January 2026 Critical Patch Update, meaning organizations that remain vulnerable have had the fix available for roughly seven months.
CVE-2026-21962 affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 of affected components, although the Microsoft IIS variant is limited to version 12.2.1.4.0. The vulnerability is located in the proxy infrastructure positioned between internet-facing web servers and backend WebLogic applications rather than in WebLogic Server itself.
That location makes the flaw particularly dangerous. An attacker with network access can exploit it without credentials or user interaction, potentially bypassing protections at the proxy layer and gaining unauthorized access to information handled by backend applications.
Researchers have traced the underlying weakness to inconsistent handling of specially crafted web addresses by the proxy and backend WebLogic infrastructure. By manipulating a request path, an attacker can potentially cause the front-end component and backend server to interpret the same request differently, circumventing restrictions intended to protect internal resources.
Security researcher gregk4sec identified a path-traversal technique associated with the issue in September 2025, according to the supplied research. A public proof-of-concept exploit subsequently appeared on GitHub on Jan. 22, two days after Oracle released its January security update.
Attack activity followed almost immediately. CloudSEK said a honeypot configured to resemble a vulnerable WebLogic 14.1.1.0.0 environment received its first CVE-2026-21962 exploitation attempt on the same day the public proof of concept appeared.
During a 12-day monitoring period ending Feb. 3, CloudSEK recorded more than 140,000 attack attempts originating from 21 countries. Researchers said much of the traffic came through rented virtual private servers, suggesting attackers were conducting automated, large-scale scans rather than manually selecting individual organizations.
CloudSEK characterized the activity as "widespread automated scanning and exploitation attempts" and described the rapid weaponization as a "zero-day-like scenario where attackers didn't wait for organizations to test their patches."
The threat later moved beyond broad internet scanning. SOCRadar reported in July that a China-linked actor incorporated CVE-2026-21962 into a collection of 11 exploit chains targeting government, healthcare, education and commercial networks across more than 100 countries.
BankInfoSecurity reporting linked the activity to actors associated with UNC5174 and UNC6586, which researchers have assessed as contractors connected to China's Ministry of State Security. The campaign reportedly made use of publicly available exploit code, tunneling utilities, GoCobaltStrike and several malware families, including the Linux-focused SNOWLIGHT loader.
Taiwan was a particularly prominent target, according to SOCRadar's analysis. The Hacker News separately reported that the broader campaign extended across government and commercial infrastructure in more than 100 countries.
CISA's decision to add CVE-2026-21962 to the KEV catalog formally establishes that the vulnerability is being exploited in real-world attacks. Under the agency's BOD 26-04 framework, the combination of internet exposure, automated exploitation, serious potential impact and confirmed attacks can produce the shortest federal remediation window: three calendar days.
The directive applies to Federal Civilian Executive Branch agencies rather than private businesses. The urgency, however, extends beyond Washington because the exploitation documented by CloudSEK and SOCRadar wasn't confined to U.S. government networks.
Oracle's middleware has also remained a persistent target because organizations continue operating systems vulnerable to older flaws. CloudSEK said its honeypot simultaneously detected attempts targeting vulnerabilities dating to 2020 and 2017, including CVE-2020-14882, CVE-2020-14883, CVE-2020-2551 and CVE-2017-10271.
That pattern means patching CVE-2026-21962 alone may not eliminate an organization's WebLogic exposure. Systems that receive Oracle's January update but remain vulnerable to older KEV-listed weaknesses could still provide attackers with alternative routes into the same environment.
