Total Takeover: Critical CVSS 10 Flaw Found in Oracle Fusion Middleware

Oracle has kicked off 2026 with a Critical Patch Update that includes a maximum-severity flaw in Oracle Fusion Middleware, tracked as CVE-2026-21962, which could allow attackers to seize complete control over affected servers without a password. The advisory notes it is easily exploitable and unauthenticated, requiring only a malicious HTTP request sent to the server to compromise the system, effectively handing an attacker full access to create, delete or modify data.

The vulnerability affects Oracle HTTP Server and WebLogic Server Proxy Plug-in (Apache) and WebLogic Server Proxy Plug-in for IIS, with specific versions listed for audit: 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, and 12.2.1.4.0 for the IIS plug-in. This flaw is part of a January 2026 update addressing 158 unique CVEs, in a patch release comprising 337 security updates across 30 product families, with 45.7% of high-severity patches indicating a broad attack surface defenders must secure. Administrators are urged to apply the update immediately before the flaw is weaponised in the wild.