Hackers Actively Exploiting Critical WebLogic RCE Vulnerabilities in Attacks

A high-interaction honeypot recorded immediate, large-scale automated exploitation attempts targeting a newly disclosed critical Oracle WebLogic RCE (CVE-2026-21962, CVSS 10.0) after exploit code was published. Attackers used rented VPS hosts and tools such as libredtail-http and the Nmap Scripting Engine to perform broad "spray and pray" scans, attempted the new ProxyServlet GET exploit and probed for historical WebLogic and unrelated vulnerabilities; the report urges immediate patching, restricting console access, deploying WAFs, and monitoring logs to avoid total compromise.