CISA Orders Federal Agencies to Patch the Actively Exploited Oracle Flaw by August 27

2026-08-27

CISA added CVE-2026-21962 (CVSS 10.0) to the KEV catalog following active exploitation of the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Federal agencies must apply the January 2026 patch by August 27.