CISA added exactly one vulnerability to its Known Exploited Vulnerabilities catalog on 24 August 2026. The catalog's own feed gives it a due date of 27 August — three days.
The vulnerability was patched seven months earlier.
What it is
CVE-2026-21962, CVSS 10.0, in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CISA's catalog classifies it as CWE-284, improper access control, and describes the result as unauthorized creation, deletion or modification access to critical data, as well as complete access to all data those components can reach.
No authentication. Network access over HTTP is enough.
The affected component matters as much as the score. Proxy plug-ins sit in front of the application server, frequently in a DMZ, which is to say on the part of the estate that is deliberately reachable from the internet.
The timeline is the story
- 20 January 2026 — Oracle ships the fix in its January Critical Patch Update.
- 22 January 2026 — exploit code is published. A CloudSEK honeypot running WebLogic 14.1.1.0.0 logs the first exploitation attempt the same day.
- February 2026 — a single address, 193.24.123[.]42, is seen trying this flaw alongside CVE-2020-14882, CVE-2020-14883, CVE-2020-2551 and CVE-2017-10271.
- 25 March 2026 — CloudSEK publishes the honeypot study.
- 24 August 2026 — CISA adds it to the KEV catalog.
- 27 August 2026 — the federal due date.
Seven months of public exploit code and documented attacks, then a three-day deadline.
That is not a criticism of the deadline. It is the observation that the deadline is the part of the process that moves fast, and the listing is the part that does not. An organisation waiting for KEV to tell it what to patch was, in this case, waiting from January to August.
The company alongside it in that February traffic tells you who else was interested: CVE-2017-10271 is nine years old. That is the same pattern as UAT-10147, which selected 170,000 targets by machine and then fired old CVEs at them.
The directive nobody wrote about
The KEV entry cites BOD 26-04, issued 10 June 2026. It is worth knowing what that is, because it quietly replaced the regime most people still describe as current.
BOD 26-04 supersedes and revokes BOD 22-01 — the November 2021 directive that created the KEV catalog — and also revokes BOD 19-02 from 2019. Both are now marked Revoked on CISA's own site.
Urgency under the new directive is set by four questions rather than a flat clock:
| Variable | Question |
|---|---|
| Asset Exposure | Is the vulnerable asset publicly exposed? |
| KEV Status | Is the CVE in the KEV catalog? |
| Exploit Automation | Can an adversary automate every step of exploitation? |
| Technical Impact | Does exploitation give partial or total control? |
CVE-2026-21962 answers badly on all four, which is how a listing on Monday becomes a deadline on Thursday.
The requirement that should change your incident plan
BOD 26-04 does not stop at patching. It establishes expectations for forensic triage — when agencies must check whether threat actors compromised the system before the patch was applied.
For a flaw with public exploit code since January and a listing in August, that is not a formality. Patching now closes the door; it says nothing about the preceding seven months. The KEV entry's notes link to CISA's forensic triage requirements alongside the patch link, which is the directive working exactly as designed.
The reasoning CISA gives for the new approach names the cause directly: cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation.
That is a US federal directive citing AI as the reason the old timelines no longer hold — the same force that took Spring from 16 disclosed vulnerabilities in 2025 to over 200 this year, read from the other side.
One oddity worth flagging
The catalog's required action for this entry still reads: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product.
BOD 22-01 was revoked in June. The reference is almost certainly standing boilerplate rather than a substantive instruction, and nothing about the remediation changes because of it. It is still a stale pointer in the authoritative feed, and if you are automating against KEV, that field is not a reliable guide to which directive governs you.
What to do
- Check whether you run the proxy plug-in, not just WebLogic. The Apache HTTP Server and Microsoft IIS plug-ins are the affected components, and they are often installed by a different team than the one that owns the app server.
- Patch to the January 2026 CPU or later. The fix has existed for seven months.
- Then look backwards. Public exploit code since 22 January means a patch is not an all-clear. Pull what logs you have for that window.
- Do not treat KEV listing as the start of exposure. This entry is the clearest possible demonstration that it is not.
- Read BOD 26-04 if you benchmark against federal practice. A lot of private-sector policy still cites BOD 22-01 by name.
What is not established
- Victim counts. None published.
- Attribution. No actor named.
- Ransomware use. The KEV entry records it as Unknown, which means undetermined rather than ruled out.
- Why the gap was seven months. CISA has not explained the timing, and the criteria for addition are not the same as the criteria for noticing.
