CISA added CVE-2026-21962 to its KEV catalog after active exploitation. Federal agencies have 72 hours to patch the critical Oracle HTTP server flaw. All organizations urged to prioritize.
CISA has ordered federal agencies to patch a critical Oracle vulnerability within 72 hours, after reports that the flaw is now being actively exploited. The vulnerability, CVE-2026-21962, affects Oracle's HTTP server and WebLogic proxy plugin. It carries a CVSS score of 10, the highest severity rating possible, and a fix has been available since January.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 24. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must apply the patch within three days. The directive requires agencies to prioritize remediation of vulnerabilities on publicly exposed assets that could grant total control of the system after exploitation, CISA said.
The agency also urged organizations outside government to adopt a risk-based approach to patching. Todd Schell, principal product manager at Ivanti, said that not all CVEs are equal. "The patches need to be triaged to identify those CVEs that require immediate attention, including those tied to known exploitation or disclosure, known malware, CISA's KEV list, or internet-facing or unauthenticated vulnerabilities," Schell said. Even high-severity CVEs that are not exploited or not internet-facing can be handled in a second round, he added.
The Oracle flaw is now on the KEV list, which CISA describes as a frequent attack vector for malicious actors. Organizations that have not yet applied the January patch should treat it as a top priority, Schell said.
Oracle's Alpha Score stands at 47 out of 100, reflecting a mixed outlook; the security event adds an operational risk factor for the company.
CISA issued the alert on August 24. Agencies have until August 27 to apply the patch.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.