TECH NEWS

CISA Warns of Exploited Oracle WebLogic Vulnerability

https://www.securityweek.com/wp-content/uploads/2025/01/CISA-Agency-Cybersecurity.jpg

Vulnerabilities

The vulnerability is tracked as CVE-2026-21962 and it has been widely exploited by threat actors against WebLogic servers.

The cybersecurity agency CISA has instructed government organizations to immediately patch a critical vulnerability that has been widely exploited in attacks against Oracle WebLogic servers.

The remote code execution flaw, identified as CVE-2026-21962 with a CVSS score of 10, affects Oracle HTTP Server and the WebLogic Server Proxy plugin, which bridges HTTP Server to WebLogic.

The security hole can be exploited without authentication to hack affected servers. Oracle patched the vulnerability with its January 2026 updates.

CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities (KEV) catalog on August 24 and instructed federal agencies to address it by August 27.

[ Read:CISA Tells Federal Agencies to Prioritize Patches Based on Risk]

While the KEV list is primarily designed for government agencies, all organizations can use it to prioritize patching,...

Copyright of this story solely belongs to securityweek.com. To see the full text click HERE

Read more

https://cdn.mos.cms.futurecdn.net/DVffQnnibMWmNpx2Wfb5Se-1920-80.jpg

'AI security controls are only as strong as the wider application environment around them': OpenAI forced to patch after experts bypass ChatGPT 'lockdown mode' to gain access to entire chat history

* Researchers bypassed ChatGPT Lockdown Mode, showing prompt-injection attacks could evade built-in protections * The flaw enabled sandbox escapes that could support data theft, phishing, malware delivery, or malicious popups * OpenAI patched the issue server-side, highlighting risks in AI application layers beyond the model itself OpenAI was recently forced to upgrade ChatGPT&