Hackers Actively Exploit Critical WebLogic RCE Vulnerabilities in Ongoing Attacks

A critical unauthenticated Remote Code Execution vulnerability in Oracle WebLogic (CVE-2026-21962, CVSS 10.0) is being actively exploited in the wild; honeypot telemetry shows immediate, high-volume automated scanning and successful command execution after public exploit code appeared. The report also documents ongoing attacks against older high‑severity WebLogic flaws (CVE-2020-14882/14883, CVE-2020-2551, CVE-2017-10271), attacker use of rented VPS hosting and scanners (eg. libredtail-http, Nmap NSE), and urges urgent patching, network restrictions, WAF deployment, and enhanced logging to mitigate risk.