CVE-2026-21962 — Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability.¶

Key facts

CVE-2026-21962 is a Critical (10.0) vulnerability: Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability.. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-24), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2026-21962 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-24), confirming exploitation in the wild. Federal remediation deadline: 2026-08-27. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2026-21962
Severity	Critical (10.0)
CISA KEV	Actively exploited (added 2026-08-24)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-21962/

Details¶

CVE-2026-21962 is a Critical (10.0) vulnerability: Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability.. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability. This vulnerability allows unauthenticated attackers to bypass authentication controls by sending specially crafted HTTP requests to proxy components, gaining unauthorized access to protected administrative functions and internal system resources.

Vulnerability Details¶

Field	Value
CVE ID	CVE-2026-21962
CVSS Score	10.0 (Critical)
CWE	CWE-284 (Improper Access Control)
Type	Authentication Bypass
Affected Products	Oracle HTTP Server, WebLogic Proxy Plugin
Affected Versions	12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
Attack Vector	Network
Authentication	None Required
Impact	Complete system compromise

Usage¶

python3 poc.py --target <url> [--check] [--verbose]

Arguments: - --target: Target Oracle HTTP Server/WebLogic URL - --check: Only check if target is vulnerable (safe mode) - --verbose: Enable detailed output

Examples:

# Check if target is vulnerable
python3 poc.py --target https://example.com:7001 --check

# Exploit the vulnerability
python3 poc.py --target https://example.com:7001 --verbose

# Test against local environment
python3 poc.py --target http://localhost:7001

Test Environment¶

docker-compose up -d

The test environment includes: - Oracle WebLogic Server 14.1.1.0.0 - Oracle HTTP Server with Proxy Plugin - Vulnerable configuration for testing

Access the test environment at http://localhost:7001

Prevention¶

See prevention/ directory for: - Configuration patches - Mitigation strategies - Security hardening guidelines - Updated proxy plugin configurations

Disclaimer¶

This proof-of-concept is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this code. Only use this tool against systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal and may result in criminal charges.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-21962, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-21962 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Authentication Bypass Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/console"; http_uri; pcre:"/\/console(?:\/|\?|$)/i"; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260001; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Authentication Bypass POST to Console"; flow:established,to_server; content:"POST"; http_method; content:"/console"; http_uri; pcre:"/\/console(?:\/|\?|$)/i"; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260002; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Async Endpoint Authentication Bypass"; flow:established,to_server; content:"/_async"; http_uri; pcre:"/\/_async(?:\/|\?|$)/i"; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260003; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic WS-AT Authentication Bypass"; flow:established,to_server; content:"/wls-wsat"; http_uri; pcre:"/\/wls-wsat(?:\/|\?|$)/i"; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260004; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Proxy Plugin Authentication Bypass"; flow:established,to_server; content:"/_wl_proxy"; http_uri; pcre:"/\/_wl_proxy(?:\/|\?|$)/i"; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260005; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Console Admin Access Bypass"; flow:established,to_server; content:"/console"; http_uri; content:"admin"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260006; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Console Management Access"; flow:established,to_server; content:"/console"; http_uri; content:"management"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260007; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Authentication Header Manipulation"; flow:established,to_server; content:"Authorization:"; http_header; content:"/console"; http_uri; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260008; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Proxy Plugin Traversal Attempt"; flow:established,to_server; content:"/_wl_proxy"; http_uri; content:".."; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260009; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Console Login Bypass"; flow:established,to_server; content:"POST"; http_method; content:"/console"; http_uri; content:"j_security_check"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260010; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Async Service Unauthorized Access"; flow:established,to_server; content:"/_async"; http_uri; content:"invoke"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260011; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic WS-AT Coordinator Bypass"; flow:established,to_server; content:"/wls-wsat"; http_uri; content:"coordinator"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260012; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Cookie Authentication Bypass"; flow:established,to_server; content:"Cookie:"; http_header; content:"/console"; http_uri; content:"JSESSIONID"; http_header; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260013; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle WebLogic Proxy Plugin Config Access"; flow:established,to_server; content:"/_wl_proxy"; http_uri; content:"config"; http_uri; distance:0; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260014; rev:1;)

alert tcp any any -> any [80,443,7001,7002] (msg:"CVE-2026-21962 Oracle HTTP Server Console Multiple Slash Bypass"; flow:established,to_server; pcre:"/\/+console/i"; http_uri; metadata:cve CVE-2026-21962; classtype:web-application-attack; sid:20260015; rev:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_21962_Network_Traffic_Console_Bypass
{
    meta:
        description = "Detects CVE-2026-21962 authentication bypass attempts targeting /console endpoint"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $endpoint1 = "/console" nocase
        $endpoint2 = "//console" nocase
        $endpoint3 = "/./console" nocase
        $endpoint4 = "/%2e/console" nocase
        $endpoint5 = "/console/../console" nocase
        $bypass1 = "X-Forwarded-For:" nocase
        $bypass2 = "X-Real-IP:" nocase
        $bypass3 = "X-Originating-IP:" nocase
        $bypass4 = "Host: localhost" nocase
        $bypass5 = "Host: 127.0.0.1" nocase
        $method = "GET " nocase
        $protocol = "HTTP/1."

    condition:
        $method and $protocol and any of ($endpoint*) and any of ($bypass*)
}

rule CVE_2026_21962_Network_Traffic_Async_Bypass
{
    meta:
        description = "Detects CVE-2026-21962 authentication bypass attempts targeting /_async endpoint"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $endpoint1 = "/_async" nocase
        $endpoint2 = "//_async" nocase
        $endpoint3 = "/./_async" nocase
        $endpoint4 = "/%2e/_async" nocase
        $header1 = "Authorization: Basic" nocase
        $header2 = "Cookie:" nocase
        $header3 = "X-Requested-With:" nocase
        $exploit1 = "%00" nocase
        $exploit2 = "../" nocase
        $exploit3 = "..%2f" nocase
        $protocol = "HTTP/1."

    condition:
        $protocol and any of ($endpoint*) and (any of ($header*) or any of ($exploit*))
}

rule CVE_2026_21962_Network_Traffic_WLS_WSAT_Bypass
{
    meta:
        description = "Detects CVE-2026-21962 authentication bypass attempts targeting /wls-wsat endpoint"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $endpoint1 = "/wls-wsat" nocase
        $endpoint2 = "//wls-wsat" nocase
        $endpoint3 = "/./wls-wsat" nocase
        $endpoint4 = "/%2e/wls-wsat" nocase
        $soap1 = "SOAPAction:" nocase
        $soap2 = "Content-Type: text/xml" nocase
        $soap3 = "Content-Type: application/soap+xml" nocase
        $method1 = "POST " nocase
        $method2 = "GET " nocase
        $protocol = "HTTP/1."

    condition:
        $protocol and any of ($method*) and any of ($endpoint*) and any of ($soap*)
}

rule CVE_2026_21962_Network_Traffic_WL_Proxy_Bypass
{
    meta:
        description = "Detects CVE-2026-21962 authentication bypass attempts targeting /_wl_proxy endpoint"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $endpoint1 = "/_wl_proxy" nocase
        $endpoint2 = "//_wl_proxy" nocase
        $endpoint3 = "/./_wl_proxy" nocase
        $endpoint4 = "/%2e/_wl_proxy" nocase
        $proxy1 = "WL-Proxy-Client-IP:" nocase
        $proxy2 = "WL-Proxy-SSL:" nocase
        $proxy3 = "Proxy-Authorization:" nocase
        $encoding1 = "%2f" nocase
        $encoding2 = "%5c" nocase
        $encoding3 = "%252e" nocase
        $protocol = "HTTP/1."

    condition:
        $protocol and any of ($endpoint*) and (any of ($proxy*) or any of ($encoding*))
}

rule CVE_2026_21962_Exploit_Payload_Path_Traversal
{
    meta:
        description = "Detects CVE-2026-21962 exploit payloads using path traversal techniques"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $payload1 = "..%2f..%2f..%2fconsole" nocase
        $payload2 = "..%5c..%5c..%5cconsole" nocase
        $payload3 = "%2e%2e%2f%2e%2e%2fconsole" nocase
        $payload4 = "/%252e%252e/%252e%252e/console" nocase
        $payload5 = "/console%00.jsp" nocase
        $payload6 = "/console%2e%00" nocase
        $payload7 = "console/../../../etc/passwd" nocase
        $payload8 = "console/..%5c..%5c..%5cwindows%5csystem32" nocase
        $http = "HTTP/" nocase

    condition:
        $http and any of ($payload*)
}

rule CVE_2026_21962_Exploit_Payload_Header_Manipulation
{
    meta:
        description = "Detects CVE-2026-21962 exploit payloads using header manipulation"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "medium"

    strings:
        $header1 = "X-Forwarded-Host: localhost" nocase
        $header2 = "X-Forwarded-Server: 127.0.0.1" nocase
        $header3 = "X-Rewrite-URL: /console" nocase
        $header4 = "X-Original-URL: /console" nocase
        $header5 = "Referer: http://localhost/console" nocase
        $header6 = "Host: internal.domain.local" nocase
        $endpoint1 = "/console" nocase
        $endpoint2 = "/_async" nocase
        $endpoint3 = "/wls-wsat" nocase
        $endpoint4 = "/_wl_proxy" nocase

    condition:
        any of ($header*) and any of ($endpoint*)
}

rule CVE_2026_21962_Log_Entry_Bypass_Attempt
{
    meta:
        description = "Detects CVE-2026-21962 authentication bypass attempts in log entries"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "high"

    strings:
        $log_format1 = "GET /console" nocase
        $log_format2 = "POST /_async" nocase
        $log_format3 = "GET /wls-wsat" nocase
        $log_format4 = "POST /_wl_proxy" nocase
        $bypass_indicator1 = "200" 
        $bypass_indicator2 = "302"
        $bypass_indicator3 = "403"
        $bypass_indicator4 = "401"
        $suspicious1 = "..%2f" nocase
        $suspicious2 = "%252e" nocase
        $suspicious3 = "X-Forwarded" nocase
        $timestamp = /\d{1,2}\/\w{3}\/\d{4}:\d{2}:\d{2}:\d{2}/

    condition:
        $timestamp and any of ($log_format*) and any of ($bypass_indicator*) and any of ($suspicious*)
}

rule CVE_2026_21962_Log_Entry_Successful_Bypass
{
    meta:
        description = "Detects successful CVE-2026-21962 authentication bypass in log entries"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "critical"

    strings:
        $success_code = " 200 "
        $redirect_code = " 302 "
        $endpoint1 = "/console" nocase
        $endpoint2 = "/_async" nocase
        $endpoint3 = "/wls-wsat" nocase
        $endpoint4 = "/_wl_proxy" nocase
        $user_agent = "User-Agent:" nocase
        $no_auth = "- - " 
        $encoding = "%2e" nocase
        $traversal = "../" nocase
        $ip_pattern = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/

    condition:
        $ip_pattern and ($success_code or $redirect_code) and any of ($endpoint*) and ($no_auth or $encoding or $traversal)
}

rule CVE_2026_21962_WebLogic_Error_Pattern
{
    meta:
        description = "Detects WebLogic error patterns related to CVE-2026-21962 exploitation"
        author = "Security Analyst"
        date = "2024-01-15"
        reference = "CVE-2026-21962"
        severity = "medium"

    strings:
        $error1 = "weblogic.servlet.security.ServletSecurityManager" nocase
        $error2 = "Authentication failed" nocase
        $error3 = "Authorization denied" nocase
        $error4 = "Invalid session" nocase
        $endpoint1 = "console" nocase
        $endpoint2 = "_async" nocase
        $endpoint3 = "wls-wsat" nocase
        $endpoint4 = "_wl_proxy" nocase
        $exploit_indicator1 = "%2e%2e" nocase
        $exploit_indicator2 = "../" nocase
        $exploit_indicator3 = "X-Forwarded" nocase

    condition:
        any of ($error*) and any of ($endpoint*) and any of ($exploit_indicator*)
}

:material-file-download: prevention/yara.yar

# CVE-2026-21962 - Prevention Rules for Nginx
# Oracle HTTP Server / WebLogic Proxy Plugin Authentication Bypass

# Rate limiting for sensitive endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=console_limit:10m rate=5r/m;

# Map for suspicious user agents
map $http_user_agent $suspicious_agent {
    default 0;
    ~*(?:curl|wget|python|perl|ruby|java|go-http) 1;
    ~*(?:scanner|bot|crawl|spider) 1;
    "" 1;
}

# Map for malicious headers that could bypass authentication
map $http_x_forwarded_for $malicious_xff {
    default 0;
    ~*(?:127\.0\.0\.1|localhost|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.) 1;
}

map $http_x_real_ip $malicious_real_ip {
    default 0;
    ~*(?:127\.0\.0\.1|localhost|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.) 1;
}

# WebLogic Console Protection
location /console {
    limit_req zone=console_limit burst=3 nodelay;

    # Block suspicious user agents
    if ($suspicious_agent) {
        return 403;
    }

    # Block requests with malicious forwarded headers
    if ($malicious_xff) {
        return 403;
    }

    if ($malicious_real_ip) {
        return 403;
    }

    # Require specific headers for legitimate requests
    if ($http_referer !~* "^https?://[^/]+/console") {
        set $auth_bypass_check "${auth_bypass_check}1";
    }

    # Block direct access without proper session
    if ($http_cookie !~* "JSESSIONID|ADMINCONSOLESESSION") {
        set $auth_bypass_check "${auth_bypass_check}2";
    }

    # Check for authentication bypass attempts
    if ($request_uri ~* "(?:\.\./|\.\.\\|%2e%2e%2f|%252e%252e%252f)") {
        return 403;
    }

    # Block requests with suspicious query parameters
    if ($args ~* "(?:debug|test|admin|root|bypass|skip)") {
        return 403;
    }

    # Enforce HTTPS
    if ($scheme != "https") {
        return 301 https://$server_name$request_uri;
    }

    # Additional security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    proxy_pass http://backend_weblogic;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# Async endpoint protection
location /_async {
    limit_req zone=auth_limit burst=5 nodelay;

    # Only allow POST requests
    if ($request_method !~ ^(POST)$) {
        return 405;
    }

    # Block suspicious user agents
    if ($suspicious_agent) {
        return 403;
    }

    # Require valid content type
    if ($content_type !~* "application/json|application/x-www-form-urlencoded") {
        return 400;
    }

    # Check for authentication bypass patterns
    if ($request_uri ~* "(?:\.\.\/|\.\.\\|%2e%2e%2f|bypass|admin)") {
        return 403;
    }

    # Require authentication headers
    if ($http_authorization = "") {
        set $auth_check "${auth_check}1";
    }

    if ($http_cookie !~* "JSESSIONID") {
        set $auth_check "${auth_check}2";
    }

    if ($auth_check = "12") {
        return 401;
    }

    proxy_pass http://backend_weblogic;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# WLS WSAT endpoint protection
location /wls-wsat {
    limit_req zone=auth_limit burst=3 nodelay;

    # Block suspicious user agents
    if ($suspicious_agent) {
        return 403;
    }

    # Only allow specific HTTP methods
    if ($request_method !~ ^(POST|GET)$) {
        return 405;
    }

    # Block requests with malicious headers
    if ($http_x_forwarded_host ~* "(?:127\.0\.0\.1|localhost|internal)") {
        return 403;
    }

    # Check for SOAP injection attempts
    if ($request_body ~* "(?:<script|<iframe|javascript:|vbscript:|onload=)") {
        return 403;
    }

    # Validate SOAP content type for POST requests
    if ($request_method = POST) {
        if ($content_type !~* "text/xml|application/soap\+xml") {
            return 400;
        }
    }

    # Block path traversal attempts
    if ($request_uri ~* "(?:\.\./|\.\.\\|%2e%2e%2f|%252e%252e%252f)") {
        return 403;
    }

    proxy_pass http://backend_weblogic;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# WL Proxy endpoint protection
location /_wl_proxy {
    limit_req zone=auth_limit burst=5 nodelay;

    # Block suspicious user agents
    if ($suspicious_agent) {
        return 403;
    }

    # Block direct access attempts
    if ($http_referer !~* "^https?://[^/]+/") {
        return 403;
    }

    # Check for proxy bypass attempts
    if ($args ~* "(?:host=|server=|url=|redirect=|target=)") {
        return 403;
    }

    # Block malicious forwarding headers
    if ($http_x_forwarded_server ~* "(?:127\.0\.0\.1|localhost|admin|internal)") {
        return 403;
    }

    # Validate proxy headers
    if ($http_wl_proxy_client_ip ~* "(?:script|drop|select|union|insert)") {
        return 403;
    }

    # Block authentication bypass patterns in URI
    if ($request_uri ~* "(?:bypass|skip|admin|debug|test|root)") {
        return 403;
    }

    # Block encoded bypass attempts
    if ($request_uri ~* "(?:%62%79%70%61%73%73|%61%64%6d%69%6e|%72%6f%6f%74)") {
        return 403;
    }

    proxy_pass http://backend_weblogic;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# Global protection for all WebLogic endpoints
location ~ ^/(console|_async|wls-wsat|_wl_proxy) {
    # Log suspicious requests
    access_log /var/log/nginx/weblogic_security.log combined;

    # Block common attack patterns
    if ($request_uri ~* "(?:\.\.\/|\.\.\\|%c0%af|%2e%2e%2f|%252e%252e%252f)") {
        return 403;
    }

    # Block SQL injection attempts
    if ($args ~* "(?:union|select|insert|delete|update|drop|create|alter|exec|script)") {
        return 403;
    }

    # Block XSS attempts
    if ($args ~* "(?:<script|<iframe|javascript:|vbscript:|onload=|onerror=)") {
        return 403;
    }

    # Block command injection
    if ($args ~* "(?:;|&&|\|\||`|\$\(|\${)") {
        return 403;
    }

    # Enforce request size limits
    client_max_body_size 10M;

    # Set security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-21962 - Prevention Rules for Apache httpd
# Authentication Bypass in Oracle HTTP Server / WebLogic Proxy Plugin

# Enable ModSecurity Rule Engine
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/modsec_audit.log

# Block suspicious authentication bypass patterns in Oracle WebLogic endpoints
SecRule REQUEST_URI "@beginsWith /console" \
    "id:202621962001, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Potential authentication bypass attempt on WebLogic console', \
    logdata:'URI: %{REQUEST_URI}', \
    severity:'CRITICAL', \
    tag:'CVE-2026-21962', \
    tag:'authentication-bypass', \
    tag:'oracle-weblogic'"

SecRule REQUEST_URI "@beginsWith /_async" \
    "id:202621962002, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Potential authentication bypass attempt on async endpoint', \
    logdata:'URI: %{REQUEST_URI}', \
    severity:'CRITICAL', \
    tag:'CVE-2026-21962', \
    tag:'authentication-bypass', \
    tag:'oracle-weblogic'"

SecRule REQUEST_URI "@beginsWith /wls-wsat" \
    "id:202621962003, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Potential authentication bypass attempt on WS-AT endpoint', \
    logdata:'URI: %{REQUEST_URI}', \
    severity:'CRITICAL', \
    tag:'CVE-2026-21962', \
    tag:'authentication-bypass', \
    tag:'oracle-weblogic'"

SecRule REQUEST_URI "@beginsWith /_wl_proxy" \
    "id:202621962004, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Potential authentication bypass attempt on proxy endpoint', \
    logdata:'URI: %{REQUEST_URI}', \
    severity:'CRITICAL', \
    tag:'CVE-2026-21962', \
    tag:'authentication-bypass', \
    tag:'oracle-weblogic'"

# Block malicious headers commonly used in authentication bypass
SecRule REQUEST_HEADERS:X-Forwarded-For "@detectXSS" \
    "id:202621962005, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Malicious X-Forwarded-For header detected', \
    logdata:'Header value: %{MATCHED_VAR}', \
    severity:'HIGH', \
    tag:'CVE-2026-21962', \
    tag:'header-injection'"

SecRule REQUEST_HEADERS:X-Real-IP "@detectXSS" \
    "id:202621962006, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Malicious X-Real-IP header detected', \
    logdata:'Header value: %{MATCHED_VAR}', \
    severity:'HIGH', \
    tag:'CVE-2026-21962', \
    tag:'header-injection'"

# Block attempts to bypass authentication via crafted User-Agent strings
SecRule REQUEST_HEADERS:User-Agent "@contains weblogic" \
    "id:202621962007, \
    phase:1, \
    block, \
    msg:'CVE-2026-21962: Suspicious User-Agent attempting WebLogic access', \
    logdata:'User-Agent: %{MATCHED_VAR}', \
    severity:'MEDIUM', \
    tag:'CVE-2026-21962', \
    tag:'user-agent-bypass'"

# Block requests with empty or missing Authorization headers to protected endpoints
SecRule REQUEST_URI "@rx ^/(console|_async|wls-wsat|_wl_proxy)" \
    "id:202621962008, \
    phase:2, \
    chain, \
    msg:'CVE-2026-21962: Missing authorization header on protected endpoint', \
    severity:'HIGH', \
    tag:'CVE-2026-21962', \
    tag:'missing-auth'"
    SecRule &REQUEST_HEADERS:Authorization "@eq 0" \
        "block, \
        logdata:'URI: %{REQUEST_URI}'"

# Block HTTP methods that could be used for bypass
SecRule REQUEST_URI "@rx ^/(console|_async|wls-wsat|_wl_proxy)" \
    "id:202621962009, \
    phase:1, \
    chain, \
    msg:'CVE-2026-21962: Unauthorized HTTP method on protected endpoint', \
    severity:'HIGH', \
    tag:'CVE-2026-21962', \
    tag:'method-bypass'"
    SecRule REQUEST_METHOD "@rx ^(TRACE|TRACK|DEBUG|OPTIONS|PATCH)$" \
        "block, \
        logdata:'Method: %{REQUEST_METHOD}, URI: %{REQUEST_URI}'"

# mod_rewrite rules for additional protection
RewriteEngine On

# Deny access to WebLogic console without proper authentication
RewriteCond %{REQUEST_URI} ^/console [NC]
RewriteCond %{HTTP:Authorization} ^$ [NC]
RewriteRule .* - [F,L]

# Block suspicious patterns in async endpoints
RewriteCond %{REQUEST_URI} ^/_async [NC]
RewriteCond %{QUERY_STRING} (\.\.\/|\.\.\\|javascript:|vbscript:|onload=|onerror=) [NC]
RewriteRule .* - [F,L]

# Protect WS-AT endpoint from bypass attempts
RewriteCond %{REQUEST_URI} ^/wls-wsat [NC]
RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1|::1)$ [NC]
RewriteCond %{REMOTE_ADDR} !^(127\.0\.0\.1|::1)$
RewriteRule .* - [F,L]

# Block proxy endpoint access with malformed headers
RewriteCond %{REQUEST_URI} ^/_wl_proxy [NC]
RewriteCond %{HTTP:X-Forwarded-Host} (\.\.\/|javascript:|data:|file:) [NC]
RewriteRule .* - [F,L]

# Rate limiting for authentication endpoints
RewriteMap throttle prg:/usr/local/bin/throttle.pl
RewriteCond %{REQUEST_URI} ^/(console|_async|wls-wsat|_wl_proxy) [NC]
RewriteCond ${throttle:%{REMOTE_ADDR}} ^over-limit
RewriteRule .* - [F,L]

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-21962?¶

CVE-2026-21962 is a Critical (10.0) vulnerability: Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability.. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-24), confirming active exploitation in the wild.

How do I detect CVE-2026-21962?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-21962?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2026-21962 actively exploited?¶

Yes. CVE-2026-21962 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2026-08-24, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2026-08-27. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.