CVE-2026-21962: Critical Authentication & Access Control Bypass in Oracle WebLogic Server Proxy Plug-in

HERMES

HERMES THREAT SCORE & PERIMETER PROXY BYPASS

Target: Oracle WebLogic Server Proxy Plug-in (Apache / IIS / OHS)

Confidence: 99%

99 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-21962 at a maximum 10.0 (Critical) with Scope Changed (S:C). CVSS v4.0 scores 10.0. The Hermes Threat Score assigns 99 (CRITICAL). Alignment is near-absolute: front-end reverse proxies placed in front of WebLogic instances to shield administrative surfaces (/console, /wls-wsat, /bea_wls_internal) fail completely, granting immediate unauthenticated external reach into backend JMX, T3, and deserialization endpoints.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-21962: Critical Authentication & Access Control Bypass in Oracle WebLogic Server Proxy Plug-inVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTOracle WebLogic Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Oracle WebLogic Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CVE-2026-21962 is a maximum-severity security flaw residing in the Oracle WebLogic Server Proxy Plug-in (mod_wl_24.so for Apache / Oracle HTTP Server and iisproxy.dll for Microsoft IIS). The proxy plug-in is deployed on perimeter DMZ web servers to route designated traffic to backend WebLogic clusters while blocking unauthorized access to sensitive management and runtime paths.

Due to discrepancies in URI path parsing, character decoding, and header interpretation between the front-end web server engine and the native plug-in shared library, remote unauthenticated attackers can craft HTTP requests that circumvent front-end access control directives (Require all denied, <Location> blocks, URL rewrite rules). The plug-in forwards the rewritten request to the backend WebLogic server, exposing unauthenticated administrative interfaces (/console), internal web services (/wls-wsat), and deserialization gateways, resulting in complete cluster compromise and remote code execution (RCE).

1. Technical Context & Affected Software Matrix

Enterprises routinely deploy Apache HTTP Server or IIS in front of Oracle WebLogic to handle TLS termination, static asset caching, and security filtering. The WebLogic Proxy Plug-in intercepts specific URL paths or MIME types and forwards them to backend WebLogic managed servers.

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-21962`	CISA KEV Catalog Entry
Affected Components	`mod_wl_24.so`, `mod_wl.so`, `iisproxy.dll`	WebLogic Server Proxy Plug-in modules
Host Environments	Apache HTTP Server 2.4.x, IIS 10.0, Oracle HTTP Server (OHS)	Enterprise DMZ reverse proxy tiers
Affected Versions	`12.2.1.4.0`, `14.1.1.0.0`, `14.1.2.0.0`	Production enterprise deployments
Fixed Versions	Oracle Security Alert / CPU Patches (August 2026)	Vendor security updates
Attack Vector	Network (`AV:N`), Low Complexity (`AC:L`), No Privileges (`PR:N`)	Direct inbound HTTP/HTTPS requests
Exploitation Impact	Scope Change (`S:C`), Complete Confidentiality, Integrity, Availability Loss	Cluster-wide takeover, RCE, data theft

2. In-Depth Technical Decomposition: Proxy Parser Inconsistency

A. The Discrepancy Mechanism

The root cause stems from how mod_wl_24.so processes normalized URIs versus Apache’s core request processing cycle. In standard Apache configurations, administrators restrict access to WebLogic admin resources via:

<Location "/console">
    Require ip 10.0.0.0/8
</Location>
<Location "/wls-wsat">
    Require all denied
</Location>

When an HTTP request is evaluated by Apache, URI normalization strips redundant slashes, resolves relative dot segments (/./, /../), and decodes percent-encoded octets. However, mod_wl_24.so uses its own internal C string parsing logic to extract the target path and forward it across the WebLogic bridge protocol (wl-proxy).

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-21962 PROXY BYPASS ARCHITECTURE                                  |
+----------------------------------------------------------------------------------------------------+

   [Remote Attacker]
          │
          │ [1] HTTP GET /public-app;..;/console/login/LoginForm.jsp HTTP/1.1
          │     Host: dmz-proxy.corp.com
          ▼
   [Apache HTTP Server / mod_wl_24.so]
          │
          ├───► Apache Core Engine Evaluation:
          │     - Compares URI against <Location "/console">
          │     - Evaluates path as "/public-app;..;/console/login/LoginForm.jsp"
          │     - Rule match: DOES NOT MATCH "/console"
          │     - Result: Access GRANTED (treated as public-app traffic)
          │
          ├───► mod_wl_24.so Plugin Interception:
          │     - Extracts downstream path
          │     - Strips matrix parameters / normalizes path internally
          │     - Downstream path resolved to: "/console/login/LoginForm.jsp"
          │     - Bridges request to backend WebLogic managed server (Port 7001)
          ▼
   [Backend Oracle WebLogic Server (Port 7001)]
          │
          └───► Receives: GET /console/login/LoginForm.jsp
                - Bypasses perimeter perimeter ACL!
                - Attacker interacts directly with WebLogic Administration Console
                - Or pivots to /wls-wsat/CoordinatorPortType for XML Deserialization RCE
+----------------------------------------------------------------------------------------------------+

B. Secondary Smuggling Vectors

In addition to semicolon path parameter manipulation, certain versions failed to validate internal HTTP request headers when proxied through intermediate content delivery networks (CDNs). The proxy plug-in allowed attackers to inject the internal header:

WL-Proxy-Client-IP: 127.0.0.1
X-WebLogic-KeepAliveSecs: 30
X-WebLogic-Force-JVMID: JVM_AdminServer

When combined with path normalization mismatches, this header spoofing allows attackers to trick WebLogic into treating the incoming connection as an internal loopback administration call, disabling secondary defense-in-depth authorization prompts.

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

CISA KEV Inclusion: Formally cataloged by CISA under mandatory federal remediation directives.
Weaponization Vector: Automated mass scanning campaigns systematically probe corporate web perimeters for endpoints returning WebLogic-Proxy-Plugin or Apache/2.4 (Unix) mod_wl server banners.
Payload Chaining: Attackers leverage this bypass to access legacy or unpatched endpoints on backend WebLogic instances:
- XML Deserialization: Targeting /wls-wsat/CoordinatorPortType with serialized Java gadgets (CommonsCollections, Jackson) to trigger direct RCE.
- T3 / IIOP Tunneling: Encapsulating binary T3 protocols inside proxied HTTP streams to bypass perimeter firewall blocks against port 7001.
- Admin Credential Spraying: Exploiting exposed /console/j_security_check with default or harvested administrative credentials.

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	`T1190`	Exploit Public-Facing Application	Remote HTTP requests bypassing front-end proxy restrictions
Defense Evasion	`T1556`	Modify Authentication Process	Semicolon / matrix URI smuggling past Apache `<Location>` checks
Execution	`T1059`	Command and Scripting Interpreter	Invoking backend RCE payloads via exposed Java Web Services
Privilege Escalation	`T1068`	Exploitation for Privilege Escalation	Elevating from unauthenticated remote user to WebLogic system account
Discovery	`T1082`	System Information Discovery	Interrogating WebLogic Admin Console diagnostics and JMX beans

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $HTTP_SERVERS any (
  msg:"HERMES DEFENSE - Oracle WebLogic Proxy Plug-in Access Control Bypass (CVE-2026-21962)";
  flow:established,to_server;
  http.method; content:"GET";
  http.uri; pcre:"/(\;|\%3b|\%2e\%2e|\.\.)\/?(console|wls-wsat|bea_wls_internal)/i";
  classtype:web-application-attack;
  sid:202621962;
  rev:1;
  reference:cve,2026-21962;
)

B. Sigma Detection Rule

title: Oracle WebLogic Proxy Plug-in Access Control Bypass Attempt
id: 6e9e4f20-9a3b-4c28-9844-32c021962f01
status: high
description: Detects suspicious path manipulation patterns attempting to bypass front-end proxy access controls to reach Oracle WebLogic administrative consoles.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_patterns:
    cs-uri-stem|contains:
      - ';/console'
      - ';..;/console'
      - '%3b/console'
      - ';/wls-wsat'
      - ';..;/wls-wsat'
      - ';/bea_wls_internal'
  condition: selection_method and selection_patterns
falsepositives:
  - Rare legacy applications using matrix parameters with specific console names (unlikely in DMZ).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1556

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Checklist:

Inspect Front-End Web Server Logs (access_log):
- Filter for occurrences of ;, %3b, or .. preceding /console, /wls-wsat, or /bea_wls_internal.
- Correlate client IP addresses making high-frequency requests with anomalous status codes (200 OK on admin endpoints that should return 403 Forbidden).
Inspect Backend WebLogic Access Logs (access.log):
- Verify whether incoming requests to /console or /wls-wsat originated from the reverse proxy IP at the exact timestamp of front-end bypass requests.
Analyze JVM Process Telemetry:
- Monitor the WebLogic JVM process (java) for anomalous child processes (cmd.exe, /bin/sh, /bin/bash, powershell.exe).

Hunting Query (Splunk / Elasticsearch):

{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "url.path": "*;*console*"
          }
        }
      ],
      "should": [
        { "wildcard": { "url.path": "*;*wls-wsat*" } },
        { "wildcard": { "url.path": "*%3b*console*" } },
        { "wildcard": { "url.path": "*%3b*wls-wsat*" } }
      ],
      "minimum_should_match": 1
    }
  }
}

7. Mitigation & Remediation

Apply Oracle Security Patch: Immediately deploy Oracle’s security patch updating mod_wl_24.so, mod_wl.so, and iisproxy.dll across all DMZ web servers.

Enforce Strict Front-End URL Rewriting: Configure Apache to drop requests containing semicolons or path manipulation sequences before plugin execution:

RewriteEngine On
RewriteCond %{THE_REQUEST} [;\?] [NC]
RewriteCond %{REQUEST_URI} (console|wls-wsat|bea_wls_internal) [NC]
RewriteRule ^.*$ - [F,L]

Segment Backend WebLogic Admin Ports: Ensure the WebLogic Administration Server port (default 7001) and managed server ports are bound only to internal RFC 1918 interfaces and completely isolated from reverse proxies.
Disable Insecure Web Services: If not required, deactivate wls-wsat.war components on all production managed servers.