The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw affecting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
What Happened
CISA's KEV addition marks a significant escalation for the Oracle WebLogic vulnerability, which allows unauthenticated remote attackers to access and potentially exfiltrate critical data from affected systems. Oracle HTTP Server and WebLogic Server are widely deployed in enterprise environments, government agencies, and financial institutions — making this flaw particularly high-impact.
The vulnerability requires no authentication and no user interaction, lowering the barrier for mass exploitation. Threat actors do not need valid credentials to trigger the flaw, meaning any externally accessible WebLogic instance is at immediate risk.
CISA KEV Listing
The KEV catalog addition carries a binding operational directive for U.S. federal civilian executive branch (FCEB) agencies, requiring them to patch or mitigate affected systems within a mandated timeframe. While the directive applies specifically to federal agencies, CISA strongly urges all organizations running Oracle WebLogic or HTTP Server to prioritize patching.
Federal agencies must remediate this vulnerability by the deadline specified in the KEV entry. Organizations that cannot immediately patch should implement compensating controls such as:
- Network segmentation to isolate WebLogic instances from untrusted networks
- Web application firewall (WAF) rules to filter exploit patterns
- Disabling the vulnerable service or endpoint if not operationally required
Affected Products
- Oracle HTTP Server (multiple versions — consult Oracle's Critical Patch Update advisory for specific version ranges)
- Oracle WebLogic Server (multiple versions — consult Oracle's advisory)
Both products are part of the Oracle Fusion Middleware family and are commonly deployed as application servers in enterprise Java environments.
Recommended Actions
- Apply Oracle's patch immediately — consult Oracle's Critical Patch Update (CPU) advisory for the specific patch applicable to your version.
- Prioritize externally facing instances — WebLogic admin consoles and listener ports exposed to the internet are highest risk.
- Review access logs for anomalous unauthenticated access attempts or unexpected data access patterns.
- Implement network controls — restrict WebLogic management ports (7001, 7002, 9002) from public internet access.
- Enable Oracle audit logging to detect exploitation attempts post-facto.
Broader Context
Oracle WebLogic has a long history of critical vulnerabilities and is a perennial target for threat actors, including state-sponsored groups and ransomware operators. CISA's KEV listing typically indicates observed exploitation — not just proof-of-concept availability — making rapid remediation essential.
Organizations relying on Oracle middleware should review their patch cadence for Oracle's quarterly CPU releases and consider automating patch deployment for critical middleware components.