CISA Added the Oracle Proxy Bug to KEV Today. Our Harvester Pulled Four Public Exploits for It on August 8 — Sixteen Days Earlier. Here Are the Endpoints to Grep Tonight.

Patrick Duggan
2 hours ago
5 min read

CISA added [CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962) to the Known Exploited Vulnerabilities catalogue today, August 24, 2026. Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CVSS 10.0 — the maximum. Unauthenticated attackers bypass proxy access controls through path traversal and header manipulation, reaching the backend WebLogic instances the proxy exists to protect.

Our exploit harvester collected four independent public proof-of-concept repositories for it on August 8, 2026, between 16:42 and 16:45 UTC.

Sixteen days. And because this matters more than the number: that receipt is first-party. It is not an ingest of somebody else's research re-dated to look early. It is our own GitHub harvesting cron finding public exploit code, extracting the target endpoints, and writing them to our index with a timestamp we did not choose.

The receipt, stated with both timestamps

We have a hard rule here that no lead claim ships without the comparator sitting beside our own timestamp, because we published a false one in July and had to correct it. So:

Date	Source
Our harvester collects 4 public PoC repos	2026-08-08 16:42–16:45 UTC	exploit-harvester — first-party
CISA adds CVE-2026-21962 to KEV	2026-08-24	CISA

The four repositories, all public on GitHub at collection time: boroeurnprach/Ashwesker-[CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962), samael0x4/[CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962), ThumpBo/[CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962), and George0Papasotiriou/[CVE-2026-21962](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-21962)-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-.

What this lead is not: it is not a claim that we spotted the bug before anyone. SANS Internet Storm Center reported unusual inbound requests against WebLogic paths — malformed traversal sequences, injected headers — back on 28 January 2026. Somebody was probing this seven months ago. Our lead is over CISA's listing, not over first exploitation, and the honest name for it is a PoC-to-KEV lead: we saw the weaponisation wave sixteen days before the catalogue did.

That is the lead type we can actually defend, and we say so every time. Our leads live at own-index pre-staging, PoC-weaponisation detection and cluster-naming. They almost never live at CVE disclosure, because nobody reliably beats the field there.

What to grep tonight — free, no product needed

This is the useful part, and it is the reason we extract endpoints from PoC code rather than just counting repositories. Our harvester pulled these target paths out of the exploit code at confidence 95:

/weblogic/ · /wl_proxy/ · /bea_wls_internal/ · /_proxy/ · /proxy/ · /bea_wls_internal/ProxyServlet · and traversal forms such as /weblogic/..

And these request headers, at confidence 85, which are the actual mechanism — the plug-in trusts them and the attacker supplies them:

WL-Proxy-Client-IP · Proxy-Client-IP · X-Forwarded-For

Go and grep your Apache or IIS access logs for those paths right now. If you run the WebLogic proxy plug-in on Apache HTTP Server or IIS, that is a ten-minute check against months of history, and it costs nothing. The traversal sequences are distinctive enough that a hit is a hit.

Affected: Oracle HTTP Server and proxy plug-in versions [12.2.1.4](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=12.2.1.4).0, [14.1.1.0](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=14.1.1.0).0 and [14.1.2.0](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=14.1.2.0).0.

One indicator with a caveat attached, because we would rather flag the caveat than have you waste an afternoon: our harvester also extracted the IP [193.24.123.42](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=193.24.123.42) from the George0Papasotiriou repository, and our index carries it at confidence 70. A callback address embedded in a proof-of-concept is very often the researcher's own test listener rather than adversary infrastructure. Treat it as a low-confidence hunting lead, not a blocklist entry. We are not going to inflate a PoC artifact into a C2 attribution.

Why the proxy is the right place to attack

The WebLogic proxy plug-in exists to sit in front of WebLogic and decide who gets through. It is the access control. So a bug that lets an unauthenticated request bypass the plug-in's checks does not degrade your security posture gradually — it removes the component that was implementing the posture, while leaving the component in place so everything still looks correctly configured.

That is the same shape we wrote about all week, and it is worth naming again: the failure is not in WebLogic, it is in the thing standing in front of WebLogic. Your backend is patched, your proxy is deployed, your architecture diagram is correct, and the request walks through the middle on a header the plug-in was built to trust.

The pattern this is an instance of

We run a detector that measures weaponisation latency — the gap between a CVE appearing, the first public proof-of-concept landing, and CISA cataloguing it. The finding that made us build it: of 86 KEV entries we checked, 15 were already armed with public exploit code before CISA listed them.

This is number sixteen, and it is the cleanest example yet, because four separate people published working exploits on the same day and the catalogue took another two weeks and two days to catch up.

That gap is not CISA being slow — KEV requires evidence of active exploitation, which is a deliberately higher bar than "an exploit exists." Both instruments are doing their jobs. But if your patch prioritisation is driven by KEV alone, then by construction you start moving on a bug an average of two weeks after the exploit is publicly downloadable. For a CVSS 10.0 unauthenticated bypass, that is the whole game.

Watch the PoC wave, not just the catalogue. We publish ours free for exactly this reason.

Capped where we always cap it at 95 percent: we have no first-party telemetry of successful exploitation against a real victim, our four-repository count is what our harvester saw on one pass and there may well have been more, and the SANS January probing report is theirs, not ours. What is ours is the collection timestamp and the extracted endpoints, and both are checkable.

Sources

CVE-2026-21962, CVSS 10.0, Oracle HTTP Server and WebLogic Server Proxy Plug-in; added to the CISA KEV catalogue 24 August 2026. Earlier probing activity reported by SANS Internet Storm Center, 28 January 2026. Analysis by NetSPI and eSecurity Planet. PoC repository collection, endpoint extraction and the 193.24.123.42 artifact are from our own exploit-harvester, 8 August 2026.

Our own related work: the weaponisation-latency detector, and "128 CVEs Got Public Exploit Code Yesterday. Only 19 Are in CISA's Catalogue." (8 August 2026).

If you run the WebLogic proxy plug-in and you grep those paths tonight, tell me what came back — a clean result is genuinely as useful to publish as a dirty one, and almost nobody publishes the clean ones. Rate this post below.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=cisa-added-the-oracle-proxy-bug-to-kev-today-our-harvester-pulled-four-public-exploits-for-it-on-au