Oracle server bug hits maximum severity score as US cyber agency confirms active attacks

A newly catalogued security flaw in Oracle’s server software has been given the highest possible severity rating a vulnerability can get, and the US government’s cyber-security agency says it’s not a hypothetical risk - it’s already being used by attackers.

CVE-2026-21962 affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, components used by businesses to run and route traffic to web applications. The NVD listing gives it a CVSS score of 10.0 out of 10, the maximum, and describes it as “easily exploitable” by an attacker who needs no login credentials and no user interaction - just network access over HTTP.

What the bug actually does

According to Oracle’s own description on NVD, a successful attack can let an outsider create, delete or modify data the server can reach, and gain unauthorised access to that data too. The scope is also flagged as a “change,” meaning the damage isn’t confined to the vulnerable component itself - it can spill over into whatever else the affected server talks to. In plain terms: get this wrong, and someone outside your organisation could read or tamper with data well beyond the web server that was actually broken into.

Three specific product versions are named as affected: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. If you’re running the plug-in for Microsoft’s IIS specifically, only version 12.2.1.4.0 is listed as vulnerable.

So who is actually at risk

This is not a bug that touches phones, laptops, games consoles or anything else sitting on an ordinary reader’s desk. Oracle HTTP Server and WebLogic are enterprise infrastructure - the kind of software running behind the scenes at large companies, government bodies and service providers to serve up web applications, not something installed by consumers. If you don’t run a business website or backend system built on Oracle’s Fusion Middleware stack, this simply isn’t your problem.

Where it matters a great deal is for IT teams that do run this software. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 24 August 2026, a list reserved for vulnerabilities the agency has confirmed are being actively abused, not merely theorised about. US federal agencies have been given until 27 August 2026 to act - a strikingly tight three-day window that reflects how urgently CISA views the threat. Whether the exploitation is linked to ransomware is, per CISA’s own listing, currently unknown.

What to do about it

CISA’s guidance is blunt: apply Oracle’s mitigations, follow the government’s cloud-security directive (BOD 22-01) where relevant, or stop using the affected product entirely if no fix is available. The federal deadline doesn’t legally bind private companies, but security teams elsewhere running these Oracle products should treat it as the benchmark, not a suggestion - a maximum-severity, unauthenticated, remotely exploitable bug that’s already under attack is about as urgent as vulnerabilities get.

The takeaway

There’s no ambiguity in the severity score or the “actively exploited” label here - both are confirmed, not spin. But this is an infrastructure story, not a consumer one. Unless you or your employer administers Oracle HTTP Server or WebLogic directly, there’s nothing to install, disable or worry about on your own devices. For the system administrators who do, however, the message from CISA is straightforward: patch now, or pull the plug.