CISA adds Oracle flaw CVE-2026-21962 to Known Exploited Vulnerabilities Catalog

CISA said Aug. 24, 2026, that it added CVE-2026-21962 to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The flaw affects Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in and is described by CISA as an improper access control vulnerability.

CISA said the catalog is used to identify flaws that federal agencies should fix quickly. The agency said vulnerabilities of this type are a frequent attack path for malicious cyber actors and can pose significant risks to the federal enterprise.

CISA cited Binding Operational Directive 26-04, or Prioritizing Security Updates Based on Risk, as the rule that guides Federal Civilian Executive Branch agencies. It said the directive requires those agencies to prioritize rapid remediation of high-risk vulnerabilities, especially CVEs listed in the KEV Catalog on publicly exposed assets that could give an attacker total control after exploitation. CISA also said the directive sets expectations for when agencies must check whether a system was compromised before a patch was applied.

CISA said BOD 26-04 applies only to Federal Civilian Executive Branch agencies, but it urged all organizations to use risk-based vulnerability management and prioritize fixing cataloged vulnerabilities. The agency said it will continue adding vulnerabilities that meet the catalog criteria.

CISA also said people aware of an exploited vulnerability that is not yet listed in the KEV Catalog can submit it through CISA’s KEV Nomination Form. It said potential additions must have a CVE ID, evidence of exploitation and clear mitigation guidance.

Sources

• CISA Cybersecurity Advisory: CISA adds one known exploited vulnerability to catalog

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.