Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Oracle WebLogic Server Proxy Plugin (CVE-2026-21962): Overview & Takeaways

netspi.com | vulnerability | CVE-2026-21962 | #oracle | #weblogic | #cve-2026-21962 | #proxy-plugin | #dmz | #http-server

Summary

CVE-2026-21962 (CVSS 10.0) lets unauthenticated attackers bypass security in Oracle HTTP Server and WebLogic proxy plugins for Apache and IIS, exposing backend WebLogic systems in the DMZ.
CVE
CVE-2026-21962
Published
Collected

original ↗

Related coverage

vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
blog · netspi.com
Decrypting WebLogic Passwords
An exposed Samba share revealed a WebLogic install during an internal pentest; this walkthrough decrypts credentials from WebLogic configs to pivot to Oracle databases and other systems.
vulnerability · netspi.com
SQL Injection to Help You Sleep at Night
Argues production databases deserve care during pentests and shows read-only SQL injection habits across MySQL, MSSQL, and Oracle so testers can hunt vulnerabilities without corrupting live data.
vulnerability · netspi.com
Advisory: XXE Injection in Oracle Database (CVE-2014-6577)
Oracle Database's XML parser (11.2.0.3-12.1.0.2) resolves external schemas, so XXE via extractvalue() lets a CREATE SESSION holder exfiltrate data over HTTP/FTP, port-scan, or trigger SSRF.
vulnerability · netspi.com
Advisory: Oracle Forms 10g Unauthenticated Remote Code Execution (CVE-2014-4278)
Oracle Forms 10g fails to validate the ifip parameter passed to ListenerServlet, letting unauthenticated attackers execute arbitrary commands; E-Business Suite 12.0.6-12.2.4 is also affected.
blog · netspi.com
Q1 2026 Critical Vulnerability Roundup: Mitigating Risk
A Q1 2026 roundup of top exploited criticals, including unauthenticated RCE in the Oracle WebLogic Server Proxy Plugin and an Ivanti EPMM auth bypass plus path traversal combo (CVE-2026-1281/1340).
back