Critical Oracle WebLogic Server Proxy Vulnerability Lets Attackers Compromise the Server

**Oracle discloses CVE-2026-21962 — critical WebLogic Server Proxy Plug-in vulnerability**: A CVSS 3.1 10.0, unauthenticated remote flaw in Oracle HTTP Server and WebLogic Proxy Plug-ins (Apache and IIS) can bypass security controls, fully compromise confidentiality and integrity, and potentially allow attackers to pivot into backend WebLogic clusters; affected versions are listed and Oracle provides patches and temporary network-restriction mitigations.