CISA Adds Critical 10.0 Oracle WebLogic Flaw to KEV Catalog Amid Active Attacks

CISA adds a maximum-severity Oracle $ORCL flaw to its Known Exploited Vulnerabilities catalog. CVE-2026-21962 carries a maximum CVSS score of 10.0 and lets unauthenticated attackers steal or modify critical data over HTTP. Oracle $ORCL released patches in January 2026, but threat actors started actively targeting honeypots and servers in February 2026. Federal civilian agencies must patch affected systems by August 27, 2026, under Binding Operational Directive 26-04. "Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in accessible data." — CISA Releasing a patch doesn't protect enterprise systems when IT teams take seven months to install it.