CISA Adds CVE-2026-21962 to KEV as Single IP Scans Oracle WebLogic and Related Targets

The flaw stems from improper access control in the proxy plug-in, permitting network attackers to create, delete, or modify critical data without credentials. Oracle released patches in January 2026, yet exploitation persisted. Evidence shows IP 193.24.123[.]42 probing this CVE alongside CVE-2020-14882, CVE-2020-2551, and CVE-2017-10271, revealing reuse of a narrow set of high-impact WebLogic vectors. Procurement records and prior CISA directives indicate federal agencies continue operating unpatched WebLogic instances behind load balancers, where proxy plug-ins often receive delayed updates. CloudSEK honeypot data from March 2026 captured repeated attempts, confirming threat actors prioritize these components for initial access rather than zero-days. Federal Civilian Executive Branch agencies must remediate by 27 August 2026 under BOD 26-04. Independent telemetry suggests commercial entities lag further, increasing risk of supply-chain pivots from compromised proxies. Next observable signal will be whether scan volume from the known IP cluster exceeds 100 unique targets per day within 14 days of the KEV listing.