Oracle HTTP Server and WebLogic proxy plug-in access control flaw (CVE-2026-21962) — listed the year it was found, three days to fix

1A component that hands things through

A web server takes requests from users and passes some of them back to the business application platform behind it. What is affected here is the component that does the handing through. It is invisible from the front and its name rarely comes up. Yet because it touches both sides, access control failing there opens a path to whatever sits behind.

The catalog describes important data being created, deleted or altered without authorization, and everything reachable through the component becoming reachable.

2Not finished at apply the update

Most entries end with a single line about applying vendor updates. This one does not. A directive for ordering work by risk is named, requirements for preserving records are set alongside it, and responsibility for judging exposure is written down.

The same phrasing turns up again in the eighteen-year-old entry at the end of this series. How the required action is written reflects both the weight of an entry and what is happening now.

3Three days

The median allowance is 21 days, a value shared by 1,025 entries. Three days or less is rare, and most of that group reached the catalog within the year the identifier was issued. A short deadline, in other words, usually attaches to something happening now. As later articles show, there are exceptions.

4What it means to be listed in the year it was found

Of the 1,694 records this site holds as of 2026-09-04, 731 (43.2%) reached the catalog in the same year their identifier was issued, the largest group. Little time passed between disclosure and confirmed exploitation. Attackers read the same publications, so publication and exploitation converge. The articles that follow walk out along that interval as it widens to one year, three, seven, and eighteen.