The perfect 10 that belongs to nobody

CISA added a CVSS 10.0 Oracle flaw to its exploited catalog on August 24, 2026, with a deadline of August 27 [3]. Oracle disclosed it in the January Critical Patch Update, seven months earlier [1].

Every write-up I found says the same thing: actively exploited since January.

So I went looking for that evidence, and what is publicly available does not say what the coverage says it says.

What happened

CVE-2026-21962 is an improper access control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, affecting versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 [1][2]. NVD scores it 10.0: network reachable, no authentication, no user interaction, and a changed scope, meaning the damage reaches past the component that contains the bug [2].

The vector is worth a second look. Confidentiality and integrity are high, availability is none [2]. Nothing suggests this knocks a service over. It gets to ten because a proxy is a doorway, and the room behind it is where the data lives.

Oracle’s advisory does what Oracle advisories do. It names the versions and states the impact, in the language of unauthorized creation, deletion or modification of critical data [1][3]. It does not describe the mechanism.

Why this matters

The component belongs to nobody. The Proxy Plug-in is a module loaded by Apache HTTP Server or IIS to pass traffic back to WebLogic. It runs on the web server, which the web team owns. It is patched through Oracle’s Critical Patch Update, which the middleware team runs. NetSPI’s write-up notes these components sit in the DMZ and are traditionally trusted as a secure gateway [5].

That is the whole explanation for seven months. Not negligence, and not a hard patch. A component that sits on one team’s machine and inside another team’s patch cycle tends to sit in neither team’s inventory, and nothing produces a ticket for a thing nobody has listed.

A proxy is an access control decision that runs before your application sees anything. Everyone with a DMZ has some version of this arrangement, and the security value of it rests on the proxy being right about what to forward. When the proxy can be persuaded to forward something it should have refused, every control behind it is answering a question it thinks was already asked.

Technical breakdown

There is no attack-chain diagram in this post, and the reason is the story.

Oracle describes impact rather than mechanism [1]. The one public traffic sample is one the person who captured it did not believe worked. Nothing available supports drawing a sequence, and drawing one anyway would be invention dressed as analysis.

What the sources do support: the flaw lets an unauthenticated request defeat the proxy’s access control and reach a backend path it should not have reached, yielding read and write access to data available through the proxied application, with lateral movement into the backend cluster as the follow-on risk [2][5].

Tracing the exploitation claim

This is the part I did not expect, and I only found it by following citations rather than reading summaries.

The article everyone points at is a SANS Internet Storm Center diary from January 28, 2026. Its title is a question: whether the traffic is a possible exploit attempt for this CVE, or AI slop [4].

The handler describes a request to a WebLogic proxy path carrying a user agent that announces itself as an exploit and a base64 encoded command inside a header, with the encodings mixed inconsistently. His assessment of it, in his own words, is that it is an odd mix of encodings and unlikely to work [4]. He notes an uptick in requests using the wl-proxy-client-ip header beginning January 21 [4].

Then he does something I have not seen in a handler diary before. He asks three commercial AI models whether the traffic is a real exploit attempt. They disagree with each other: one calls it a scanner trying to look like an exploit, the other two call it genuine [4]. He publishes the disagreement and reaches no conclusion of his own.

That is the primary evidence behind “actively exploited since January”. A careful observer saying he could not tell, and three machines producing two different answers.

None of this means CISA is wrong. CISA has evidence it does not publish, and a KEV listing is enough to act on regardless of what the open record shows. The point is narrower: the public chain of evidence, followed to its source, is a question mark, and it has been repeated as a finding.

The proof of concept is gone

NVD’s reference list for this CVE includes a GitHub issue and an archived copy of it [2]. The live issue returns 404, and so does the repository root, which I checked. The archive capture is the only version left.

So the artifact that made this cheap to exploit was published, then withdrawn, and the vulnerability database still points at the empty space where it was. That is worth knowing if you ever plan to assess a CVE by whether a public exploit exists. That answer decays, and it decays in the direction of looking safer.

One inconsistency in the record

The KEV entry’s required action tells agencies to follow BOD 22-01 guidance for cloud services [3]. BOD 22-01 was superseded by BOD 26-04, which is the directive that sets the three day clock this entry runs on.

I checked the nine entries added before it. All nine cite 26-04. This one cites the directive it replaced. It changes nothing operationally, and it is the kind of detail worth noticing in a record people treat as authoritative.

What defenders should do Monday morning

Immediate, within 24 hours. Find out whether you run this at all, and look on the web servers rather than the WebLogic servers. Check loaded Apache modules and IIS extensions, deployment manifests, and container images [5]. The plug-in rarely appears under its own name in an asset inventory, which is the reason this whole situation exists.

Near term, this week. Apply the January Critical Patch Update to affected components, which Oracle treats as the complete remediation [1][5]. If that cannot happen quickly, restrict who can reach the proxy from outside and treat reduced exposure as a holding position rather than a fix. Then review access logs for malformed requests to WebLogic paths and for unusual use of the wl-proxy-client-ip header, which is the one concrete hunting artifact the public record offers [4].

Structural, this quarter. Find the other components like this one. Every estate has software that runs on one team’s servers and patches on another team’s schedule: agents, plug-ins, connectors, forwarders, database clients. Write down who owns the patch decision for each, by name. That list is short, boring, and it is where the next seven month gap is already forming.

Checklist

• Web servers checked for the Oracle Proxy Plug-in, not just WebLogic hosts
• Apache modules, IIS extensions, manifests and container images reviewed
• Affected versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 identified
• January Critical Patch Update applied to affected components
• External reachability of the proxy restricted where patching lags
• Access logs reviewed for malformed WebLogic path requests
• Unusual wl-proxy-client-ip header use hunted in historic logs
• Every plug-in, agent and connector assigned a named patch owner

What “actively exploited” is carrying

There is a sentence that appears in almost every vulnerability write-up, including some of mine: this flaw is being actively exploited. It is doing an enormous amount of work, and it is almost never sourced.

Follow it far enough and it usually terminates in one of three places. A vendor with a product to sell. A honeypot operator reporting scans, which are not compromises. Or, as here, a careful person publishing genuine uncertainty, which the next writer converts into confirmation because the hedge does not survive being summarised.

None of that argues for ignoring the catalog. CISA sees telemetry nobody else does, the listing is the right trigger, and the deadline is a reasonable read of urgency.

It argues for noticing when you are repeating a claim rather than making one. The version of this trade that is worth practising is being able to say where a fact came from, and being willing to say that the answer is a question mark when it is.