CISA Adds CVE-2026-21962 to Known Exploited Vulnerabilities Catalog

CISA added CVE-2026-21962, an improper access control flaw in Oracle HTTP Server and the Oracle Weblogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog on 2026-08-24. Federal agencies have until 2026-08-27 to apply mitigations per vendor instructions or discontinue use.

Source:CISA KEV

Post

CISA Adds CVE-2026-21962 to Known Exploited Vulnerabilities Catalog

TL;DRAI · 60 sec read

CISA has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog. The flaw affects Oracle HTTP Server along with the Oracle Weblogic Server Proxy Plug-in and is reportedly being actively exploited.

CISA catalogs an improper access control vulnerability. The products contain an improper access control vulnerability that reportedly can allow unauthorized creation, deletion or modification of critical data in addition to unauthorized access to critical data or full access to all data reachable by the affected components. The vulnerability is tracked as CVE-2026-21962 and is related to CWE-284.

It is unknown whether the vulnerability is known to be used in ransomware campaigns.

It was added to the catalog on 2026-08-24. Federal agencies must remediate by 2026-08-27.

Required actions target federal systems. Agencies are directed to "apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." Additional notes reference the Oracle security alert at https://www.oracle.com/security-alerts/cpujan2026.html.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

CISA also points to BOD 26-04 on prioritizing security updates based on risk and its implementation guidance. Forensics triage requirements are available in the linked directive.

Impact remains unknown in ransomware context. It is unknown whether the vulnerability is known to be used in ransomware campaigns. The NVD entry is available at https://nvd.nist.gov/vuln/detail/CVE-2026-21962.

The directive also references related BOD 26-04 materials on risk-based patching prioritization.

EXPERT TAKE

The three-day remediation deadline for federal systems signals that exploitation is widespread enough to warrant immediate prioritization under BOD 26-04 risk-based patching.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Oracle Security Vulnerability CISA

MORE IN TECH

Apple raises prices $100 across every remaining previous-generation iPhone

Apple has raised prices by $100 on the iPhone 16, full iPhone 17 lineup and iPhone Air immediately after unveiling the iPhone Duo and iPhone 18 Pro, according to tipster reports. The move means an affordable iPhone now costs more than it did yesterday.

Apple Launches Its C2 Cellular Modem Alongside iPhone Duo

Apple introduced the C2 modem with the iPhone Duo announcement, promising up to 50% faster uploads, 15% lower power consumption, and mmWave support in the US. Fully integrated with the A20 Pro and iOS 27, the platform uses AI algorithms to strengthen connection reliability in weak signal areas.

Windows 10 1607 DHCP Server Hit by CVSS 8.0 Vulnerability

Microsoft disclosed CVE-2026-69412, an 8.0-rated stack-based buffer overflow in Windows DHCP Server that lets an authenticated attacker execute code over an adjacent network, affecting Windows 10 1607. Patches are available while exploitation remains unlikely with no known attacks reported.