Detect Oracle HTTP Server / WebLogic Proxy Plug-in Improper Access Control (CVE-2026-21962) in CrowdStrike LogScale
Detects exploitation attempts and successful exploitation of CVE-2026-21962, an improper access control (CWE-284) vulnerability in the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (mod_wl / mod_weblogic). The flaw allows unauthenticated remote attackers to bypass intended access restrictions on proxied WebLogic back-ends, reaching administrative consoles, internal management endpoints, and paths that should be filtered by the reverse proxy. CISA added this CVE to the KEV catalog on 2026-08-24. Detection focuses on anomalous proxied requests to sensitive WebLogic paths (/console, /wls-wsat, /management, /em), access-control bypass patterns such as path traversal, double-encoding, and semicolon/URL-normalization tricks against the proxy, and web-server access logs where the proxy forwarded requests it should have denied.
MITRE ATT&CK
- Tactic
- Initial Access Lateral Movement
LogScale Detection Query
#event_simpleName=/HttpRequest|WebProxy/i
| lower(field=RequestUrl, as=url)
| url=/(\/console|\/wls-wsat|\/management|\/bea_wls_internal|\/wls-exporter|\/_async)/
| bypass := if(regex("(\.\.;|%2e%2e|%252e|\/\/|%2f%2f|%00)", field=url), then=1, else=0)
| groupBy([RemoteAddressIP4, ComputerName], function=[count(as=hits), sum(bypass, as=bypass_hits), collect([url])])
| test(hits >= 3 OR bypass_hits >= 1)
| sort(hits, order=desc)CrowdStrike CQL (LogScale) over HTTP request / web-proxy telemetry for sensitive WebLogic proxy paths and bypass encodings, aggregated by remote source IP and host.
Data Sources
Required Tables
False Positives & Tuning
- Administrators accessing /console legitimately
- Approved scanning tools
- Monitoring probes to exporter endpoints
Other platforms for CVE-2026-21962
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WebLogic console access-control bypass via path traversal
Expected signal: Web-server access log entry with URI containing '..;/console' from the test source IP
- Test 2WebLogic WSAT endpoint reach via double-encoding
Expected signal: Access log entry containing '%2e%2e/wls-wsat' from the test host
- Test 3WebLogic management endpoint enumeration burst
Expected signal: Five IIS/OHS access log entries to //management/weblogic from the test host
References (4)
- https://www.oracle.com/security-alerts/cpujan2026.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-21962
Response Playbook
Triage
- Confirm whether the targeted host runs Oracle HTTP Server or the WebLogic Server Proxy Plug-in (mod_wl/mod_weblogic) fronting a WebLogic domain, and identify the WebLogic version and January 2026 CPU patch level.
- Review the source IP's full request history: determine whether requests to /console, /wls-wsat, /management or /bea_wls_internal returned 200/302 (reached back-end) versus 403/404 (blocked by proxy).
- Correlate the source IP against threat intelligence and check whether it appears in other web-server logs across the estate, indicating scanning of KEV CVE-2026-21962.
- Determine whether any bypass request was followed by authenticated admin console activity, deployment of a new application/WAR, or WLST/management API calls.
Containment
- Apply the Oracle January 2026 Critical Patch Update for the HTTP Server / WebLogic Proxy Plug-in to the affected hosts.
- Block the offending source IP(s) at the perimeter and add proxy/WAF rules to deny external access to /console, /wls-wsat, /management, /bea_wls_internal and /wls-exporter.
- If compromise is suspected, isolate the WebLogic host from the network and rotate WebLogic administrative and datasource credentials.
Evidence Collection
- Preserve OHS/IIS/Apache access and error logs, WebLogic AdminServer.log and access.log, and any proxy plug-in debug logs covering the activity window.
- Capture the full raw HTTP requests (method, URI, headers, encodings) that bypassed proxy access controls for forensic and IOC extraction.
- Snapshot the WebLogic domain deployment directory and autodeploy folder to detect newly dropped WAR/JSP web shells.
Escalation Criteria
- !Escalate to incident response if a bypass request reached an authenticated admin endpoint (200/302 on /console or /management) from an untrusted source.
- !Escalate if there is evidence of application deployment, new JSP/WAR files, or outbound connections from the WebLogic host following the bypass attempts.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
OHS/IIS/Apache access logs showing requests to sensitive WebLogic paths with 2xx/3xx responses - >
WebLogic AdminServer access.log and domain deployment/autodeploy directory contents - >
Proxy plug-in configuration (mod_wl_ohs.conf / weblogic.conf) and any recently created JSP/WAR files
Tuning Guidance
Baseline the source IPs and subnets that legitimately administer the WebLogic console and management endpoints (jump hosts, monitoring, approved scanners) and exclude them. Tighten the bypass-encoding regex if your proxy legitimately emits double-slash URIs. Raise the per-source hit threshold in high-traffic environments, and prioritize alerts where sensitive-path requests return 200/302 over those returning 403/404.
Hunting Queries
Surfaces successful (2xx/3xx) reaches to sensitive WebLogic proxy paths, indicating the access-control bypass actually returned back-end content rather than a proxy denial.
W3CIISLog | where csUriStem has_any ("/console","/wls-wsat","/management","/bea_wls_internal") | where scStatus in ("200","302") | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h) | order by count_ descindex=web (sourcetype=iis OR sourcetype="oracle:ohs:access") (cs_uri_stem="*/console*" OR cs_uri_stem="*/wls-wsat*" OR cs_uri_stem="*/management*") (status=200 OR status=302) | stats count by src_ip, cs_uri_stemAtomic Red Team Tests
Attempts to reach the WebLogic Admin Console through the proxy using a semicolon/traversal trick that bypasses proxy path filtering (lab only).
Command
curl -sk -o /dev/null -w '%{http_code}\n' 'https://ohs-lab.example.local/..;/console/login/LoginForm.jsp'Cleanup
echo 'No cleanup required; read-only request'Expected Telemetry
Web-server access log entry with URI containing '..;/console' from the test source IP
Expected Detection
KQL/SPL rule fires on sensitive path + bypass marker from the source IP
Sends a double-URL-encoded request to /wls-wsat to test whether the proxy forwards a path it should deny (lab only).
Command
curl -sk -o /dev/null -w '%{http_code}\n' 'https://ohs-lab.example.local/%2e%2e/wls-wsat/CoordinatorPortType'Cleanup
echo 'No cleanup required'Expected Telemetry
Access log entry containing '%2e%2e/wls-wsat' from the test host
Expected Detection
Bypass-encoding branch of the detection matches on /wls-wsat request
Issues a burst of requests to internal WebLogic management paths to trigger the per-source frequency threshold (lab only).
Command
1..5 | ForEach-Object { Invoke-WebRequest -UseBasicParsing -Uri "https://ohs-lab.example.local//management/weblogic/latest/domainRuntime" -SkipCertificateCheck -ErrorAction SilentlyContinue }Cleanup
Write-Output 'No cleanup required'Expected Telemetry
Five IIS/OHS access log entries to //management/weblogic from the test host
Expected Detection
Aggregation rule fires when hits >= 3 for the source IP