CISA ORDERS FEDERAL AGENCIES TO PATCH THE ACTIVELY EXPLOITED ORACLE FLAW BY AUGUST 27

Summary from the TLDR InfoSec newsletter

CISA added CVE-2026-21962 (CVSS 10.0) to the KEV catalog following active exploitation of the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Federal agencies must apply the January 2026 patch by August 27.