CISA Orders Oracle Flaw to Be Patched Within 3 Days

Oracle Vulnerability: CISA Orders Patch Within 3 Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to patch an Oracle vulnerability within three days. The vulnerability, identified as CVE-2026-21962, affects Oracle's HTTP and WebLogic servers and could allow attackers to read, create, delete, or modify critical data.

Vulnerability Details

The issue stems from inadequate access control (CWE-284) and can be exploited via low-complexity attacks. Oracle released patches for this vulnerability in January 2026, but CISA has just added it to its catalog of known exploited vulnerabilities (KEV).

Consequences of Not Patching

Federal agencies that fail to patch within the deadline could face serious repercussions, including loss of access to critical data and exposure to cyberattacks.

• The vulnerability can be exploited by attackers to access critical data.
• Attacks require low complexity and do not demand advanced skills.
• Failure to patch could lead to severe consequences, including loss of access to critical data.

Original source: The Register