The Instant Weaponization of Oracle’s 10.0 CVSS “Zero-Day-Like” Flaw

CloudSEK’s high-interaction honeypot study shows immediate weaponization and active exploitation attempts against CVE-2026-21962 (an unauthenticated Oracle WebLogic RCE with CVSS 10.0) from the same day public exploit code was released; automated internet-wide scanning and targeted probing (including attempts to access root endpoints, .env and .git/config) were observed, often launched from rented VPS providers. The report warns of a zero-day-like window between disclosure and exploitation and recommends immediate patching, restricting console exposure to VPN/internal networks, disabling unused protocols (IIOP/T3, WLS-WSAT), and deploying WAF filters to mitigate attacks.