Critical Oracle WebLogic RCE Flaws Actively Exploited by Attackers

Key Takeaways

• A critical, maximum-severity remote code execution (RCE) vulnerability in Oracle WebLogic Server (CVE-2026-21962) is being actively exploited in the wild.
• The flaw, rated CVSS 10.0, allows unauthenticated attackers to execute arbitrary code via the WebLogic Console.
• Attackers quickly weaponized the vulnerability after exploit code became public, using automated tools and a “spray and pray” approach from rented VPS infrastructure.
• Beyond the new flaw, threat actors are also widely scanning for and exploiting several older, known WebLogic vulnerabilities.
• Immediate patching and robust network segmentation are crucial for organizations running Oracle WebLogic Server.

Critical Oracle WebLogic RCE Flaws Actively Exploited by Attackers

Threat actors are rapidly weaponizing newly disclosed software vulnerabilities, with a significant increase in exploitation observed shortly after public disclosure. Cybersecurity researchers have identified widespread, active attacks targeting a critical, recently revealed flaw in Oracle WebLogic Server, which carries the highest possible severity rating.

The vulnerability, identified as CVE-2026-21962, has a CVSS score of 10.0, indicating maximum severity. It enables unauthenticated attackers to achieve remote code execution (RCE) on susceptible servers through the WebLogic Console interface. Security experts noted that attempts to exploit this flaw began almost immediately after proof-of-concept code was made public on January 22, 2026.

This rapid deployment of exploits underscores the severe risk posed to organizations that have not yet applied necessary patches to their Oracle WebLogic Server installations.

Honeypot Reveals Widespread Automated Attacks

To gain insight into the evolving threat landscape, researchers deployed a high-interaction honeypot designed to mimic a vulnerable Oracle WebLogic Server (version 14.1.1.0.0). Over a 12-day period, this system recorded a substantial volume of malicious traffic, primarily originating from rented Virtual Private Servers (VPS) offered by major hosting providers such as DigitalOcean and HOSTGLOBAL.PLUS. These services were used by attackers to mask their true locations while launching automated, high-volume scans.

Instead of highly targeted operations, threat actors employed a broad, indiscriminate “spray and pray” methodology. Automated tools, including ‘libredtail-http’ (responsible for over 1,000 requests) and the Nmap Scripting Engine, deluged the honeypot with malicious requests. While the primary objective was to compromise the new CVE-2026-21962 vulnerability via specific ProxyServlet HTTP GET requests, attackers simultaneously probed the server for a range of older, unpatched vulnerabilities.

The collected data confirms that cybercriminals do not exclusively pursue new zero-day exploits but also heavily rely on a repertoire of established, proven vulnerabilities.

The honeypot documented consistent attacks targeting several historical WebLogic vulnerabilities:

• CVE-2020-14882 and CVE-2020-14883: These critical RCE flaws (CVSS 9.8) allowed attackers to bypass authentication and target the administrative console.
• CVE-2020-2551: A severe deserialization vulnerability within the IIOP protocol, enabling remote attackers to execute arbitrary code.
• CVE-2017-10271: An older, yet highly reliable, XML deserialization flaw in the WLS-WSAT component, frequently exploited through specially crafted SOAP requests.

Intriguingly, the automated scanning also identified vulnerabilities in unrelated systems, such as Hikvision cameras and PHPUnit, indicating that attackers cast a wide net in search of any exploitable entry point.

What You Should Do

Given the rapid weaponization of CVE-2026-21962, organizations must take immediate action to secure their networks. According to CloudSEK’s analysis, cybersecurity experts recommend the following critical defense measures:

• Apply Patches Immediately: Administrators must install the latest Oracle Critical Patch Updates (CPUs) across all WebLogic components, with particular emphasis on applying fixes for CVE-2026-21962.
• Restrict Console Access: The WebLogic administrative console should never be directly exposed to the public internet. Implement strict network segmentation, placing it behind a VPN or internal firewall.
• Deploy a Web Application Firewall (WAF): Configure WAF rules to detect and block malicious path traversal attempts, Deep Packet Inspection (DPI) evasion techniques, and known exploit signatures.
• Monitor System Logs: Continuously monitor system logs for suspicious administrative access attempts or the unexpected execution of operating system commands like wget or curl.

Leaving an Oracle WebLogic Server exposed and unpatched presents an extremely high risk of total system compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.