CVE-2026-21962

 As part of Oracle's January 2026 Critical Patch Update (CPU), CVE-2026-21962 has been identified as a Critical vulnerability (CVSS 10.0) affecting the Oracle WebLogic Server Proxy Plug-in running on Oracle HTTP Server (Apache).

 httpd.conf

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block dot-dot-slash and traversal patterns in raw and decoded URIs
    RewriteCond %{THE_REQUEST} (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|%2e%2e%5c|%2e%2e\\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
    # Block direct or nested access to administrative/internal consoles
    RewriteCond %{REQUEST_URI} ^/(console|consolehelp|em|management|bea_wls_internal|bea_wls_management_internal) [NC,OR]
    RewriteCond %{THE_REQUEST} /(console|consolehelp|em|management|bea_wls_internal|bea_wls_management_internal) [NC]
    RewriteRule .* - [F,L]
    # Block access to WebLogic Web Services Test client or internal utilities
    RewriteCond %{REQUEST_URI} ^/ws_utc [NC]
    RewriteRule .* - [F,L]
</IfModule>

 

<IfModule mod_headers.c> 
# Strip client-supplied proxy control headers before forwarding
RequestHeader unset WL-Proxy-SSL
RequestHeader unset WL-Proxy-Client-IP 
RequestHeader unset X-WebLogic-Request-Type
RequestHeader unset X-WebLogic-KeepAliveSecs 
RequestHeader unset X-Forwarded-For-Original 
</IfModule>

 

mod_wl_ohs.conf

# Restrict unauthenticated administrative path routing explicitly
<LocationMatch "^/(console|consolehelp|em|management|bea_wls_internal)($|/.*)">
SetHandler default-handler
Require all denied
</LocationMatch> 

Deployer:149150

 Error :

 Deployer:149150]An IOException occurred while reading the input. : with response code '401' : with response message 'Unauthorized'

 

ENV:

weblogic 12.2.1.4 rhel linux 9 

managed servers in a cluster of servers.

 

Solution:

Ensure all servers which are part of cluster have the clock sync'd 

OHS not starting due to outofmemory error

 Error : 

OHS failing on linux

<DATE> <SEVERE> <Plugin threw out unexpected exception java.lang.OutOfMemoryError from method oracle.ohs.plugin.nodemanager.OhsProcessManagementPlugin$ProcessImpl.start(Properties props). This is very likely a BUG in plugin implementation and may lead to unexpected behavior. The legal exception allowed from this method is java.io.IOException. The unexpected exception is: java.lang.OutOfMemoryError: GC overhead limit exceeded>
java.lang.OutOfMemoryError: GC overhead limit exceeded
        at java.util.Arrays.copyOfRange(Arrays.java:3664)
        at java.lang.String.<init>(String.java:207)
        at java.lang.StringBuilder.toString(StringBuilder.java:413)
        at oracle.ohs.plugin.nodemanager.OhsSyncConfig.addConfigTree(Unknown Source)

 

Solution:

 stop nodemanger

edit  startNodeManager.sh

add  USER_MEM_ARGS

example below 

 

JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.RootDirectory=${DOMAIN_HOME} "
export JAVA_OPTIONS
USER_MEM_ARGS="-Xms2048m -Xmx2048m -XX:MaxMetaspaceSize=512m"
export USER_MEM_ARGS
#  Set JAVA_HOME for node manager 

 

save the file.

set USER_MEM_ARGS=-Xms2048m -Xmx2048m 

start the nodemanager 

start ohs 

Unable to start Elasticsearch

 Error: 

[2026-06-05T02:31:27,577][WARN ][o.e.b.Natives] unable to load JNA native support library, native methods will be disabled.java.lang.UnsatisfiedLinkError: /home/**/.cache/JNA/temp/jna10229199309993491088.tmp: 
/***/.cache/JNA/temp/jna10229199309993491088.tmp: failed to map segment from shared object

 

Solution:

create a new folder and provide full permission and ownership

run below commands line by line before starting elasticsearch

export ES_JAVA_OPTS="$ES_JAVA_OPTS -Djava.io.tmpdir=/***/tmp"
export ES_TMPDIR=/***/tmp
export ES_JAVA_OPTS="-Djna.tmpdir=/***/tmp"

bin/elasticsearch -d -p elasticsearch.pid 

 

 

 

wlst script to restart weblogic managed server

stopserver1.py

import sys

connect('user','pw','t3://servername:7001')
domainRuntime()
shutdown('server1','Server','true',1000,'true');
shutdown('server2','Server','true',1000,'true');
exit()

stopserver1.sh

/****/oracle_common/common/bin/wlst.sh /*****/user_projects/domains/ap/restart/stopserver1.py $1 

startserver1.py

import sys

connect('user','pw','t3://servername:7001')
domainRuntime()
start('server1','Server','true',1000,'true');
start('server2','Server','true',1000,'true');
exit()

shell script to collect todays cache details of weblogic jvm and send email

 

The following shell script collects today's cache details of weblogic jvm and sends out an email.
The script can ssh to many linux servers and only collect cache details were cache has been created on the present day.

The servers should already have keyless SSH enabled between them

Below is the script

 #!/bin/sh
echo -e "\e[0;36m++++++ \e[0m"
echo -e "\e[0;36m Author : robin.richard@****.com \e[0m"
sleep 5
echo -e "\e[0;36m++++++ \e[0m"
printf "\n ======================= \n Begining cache collection in  PROD  \n ======================= \n"
sleep 4
rm -r report.txt
printf "\n ======================= \n purging old data \n ======================= \n"
echo -e "\e[0;36m++++++ \e[0m"
sleep 5
#rm -r report.txt
for i in oracle@server oracle@server oracle@server oracle@server oracle@server; do ssh $i 'echo  "Server: $(hostname) - Date: $(date)" && find /<path>/servers/*/tmp/_WL_user/ -daystart -ctime 0 -print' >> report.txt; done
sleep 4
printf "\n ======================= \n Completed Cache collection \n ======================= \n"
echo “ prod  cache details” | mail -s “Prod_cache_details” robin.richard@****.com,rramaneedi@****.com,hsinghchouhan@****.com < report.txt
printf "\n ======================= \n Sending Email \n ======================= \n"
echo -e "\e[36;41m++++++ \e[0m"
printf "\n ======================= \n Exiting the system \n ======================= \n"
echo -e "\e[36;41m++++++ \e[0m"

You can also put the script in bash profile as follows
vi ~oracle/.bashrc
alias cachecollector='/home/oracle/cache_collector/robin.sh &'

 

also you can try

for i in oracle@server oracle@server oracle@server oracle@server oracle@server; do ssh $i 'echo  "Server: $(hostname) - Date: $(date)" && echo -e "\e[0;36m++++++ \e[0m" && find /<path>/servers/*/tmp/_WL_user/ -daystart -ctime 0 -print | xargs ls -ltr && echo -e "\e[0;36m++++++ \e[0m"' >> report.txt; done 

or 

for i in oracle@server oracle@server oracle@server oracle@server oracle@server ; do ssh $i 'echo  "Server: $(hostname) - Date: $(date)" && find /<path>/servers/*/tmp/_WL_user/ -daystart -ctime 0 -print' >> report.txt; done

or 

for i in oracle@server oracle@server oracle@server oracle@server oracle@server ; do ssh $i 'echo "********" && echo  "Server: $(hostname) - Date: $(date)" && find /<path>servers/*/tmp/_WL_user/ -daystart -ctime 0 -print && echo "********"' >> report.txt; done

Print index.html from todays date

find /<path>/*/index.html -daystart -ctime 0 -print

Print folders only of todays creation date

find /<path>/*/<path>s/*/tmp/_WL_user/ -mindepth 1 -maxdepth 1 -ctime 0 -print

java.lang.ClassNotFoundException: javafx.application.Application

 PROBLEM : While installing vertex receiving javafx issues

ERROR: 

Exception in thread "main" java.lang.NoClassDefFoundError: javafx/application/Application
        at java.base/java.lang.ClassLoader.defineClass1(Native Method)
        at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1016)
        at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
        at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:800)
        at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:698)
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:621)
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:579)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
        at com.vertexinc.tps.install.app.InstallApp.main(InstallApp.java:22)
Caused by: java.lang.ClassNotFoundException: javafx.application.Application
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)

REASON: javafx has been removed from java11, however it is still available in java8

so use JDK 8 version

solr failed to start

 

Error : OpenJDK 64-Bit Server VM warning: Failed to reserve shared memory. (error = 1)

Context: this is a lucene solr 9.0.0 + zk 3.8.0. on a linux server

Solution:  

increment the heap memory at SOLR_HEAP="24g" to accommodate increased collection load.

The file /*/solr/solr-9.0.0/bin/solr.in.sh

 

 

Extract Private Key from oracle wallet

 To Extract Private Key from a wallet we would need orapki keytool and openssl.

<<<<<<<<<< Display the contents of the wallet using orapki >>>>>>>>>

/<fmw_home>/oracle_common/bin/orapki wallet display -wallet /<domain_home>config/fmwconfig/components/OHS/instances/ohs1/keystores/wallet/cwallet.sso

<<<<<<<<<<<< copy the wallet to new location say /tmp/robin/wallet >>>>>>>>>>>

convert from pkcs12 to jks and provide password

/<fmw_home>/oracle_common/bin/orapki wallet pkcs12_to_jks -wallet /tmp/robin/wallet -jksKeyStoreLoc /tmp/robin/ewallet.jks 

welcome1

 

<<<<<<<<<<<< <<<<< import keystore >>>>>>>>>>>>>>>>>>>>>>>>

keytool -importkeystore -srckeystore /tmp/robin/ewallet.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore /tmp/robin/result/ewallet.p12

<<<<<<<<<<<<<<<<<< private key will be in r.txt >>>>>>>>>>>>>>>>>>>>>>>>>>>>

openssl pkcs12 -in /tmp/robin/result/ewallet.p12 -passin pass:welcome1 -out /tmp/robin/result/r.txt -nodes

OHS not starting due to cert issue

 ERROR MSG:

<date> <Info> <Security> <BEA-090909> <Using the configured custom SSL Hostname Verifier implementation: weblogic.security.utils.SSLWLSHostnameVerifier$NullHostnameVerifier.>
This Exception occurred at <date>.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
Error: Error occurred while performing nmConnect : Cannot connect to Node Manager. : sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
Use dumpStack() to view the full stacktrace :

FACTS:

1. Nodemanager is running in SSL mode

2.OHS is configured to run on SSL mode

3. OHS uses wallet with default self signed cert

Solution:

<<<<<<<<TO DISPLAY the contents of the WALLET>

oracle_home/oracle_common/bin/orapki wallet display -wallet domain_home/ohs_domain/config/fmwconfig/components/OHS/instances/ohs1/keystores/default/cwallet.sso

<<<<<<<<< export cert to a file >>>>>>>>>>
oracle_home/oracle_common/bin/orapki wallet export -wallet . -dn "CN=localhost,OU=FOR TESTING ONLY,O=FOR TESTING ONLY" -cert domain_home/ohs_domain/config/fmwconfig/components/OHS/instances/ohs1/keystores/cert.txt

<<<<< read the cert in a file to check expiry of cert >>>>>>>>>

cd domain_home/ohs_domain/config/fmwconfig/components/OHS/instances/ohs1/keystore
/oracle_home/oracle_common/bin/orapki cert display -cert cert.txt -complete

<<<<<<<< take a backup of .sso and create a new wallet >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
oracle_home/oracle_common/bin/orapki wallet create -wallet domain_home/ohs_domain/config/fmwconfig/components/OHS/instances/ohs1/keystores/default/wallet -auto_login_only

<<<<<<<<<<<<<<<<<<<<< add new cert to the wallet (self signed cert) >>>>>>>>>>>>>>
oracle_home/oracle_common/bin/orapki wallet add -wallet domain_home/ohs_domain/config/fmwconfig/components/OHS/instances/ohs1/keystores/default -dn "CN=localhost,OU=FOR TESTING ONLY,O=FOR TESTING ONLY" -keysize 2048 -self_signed -validity 3650 -auto_login_only

start the ohs

bash script to check URL status from a linux box

 

Wrote a script to check valid urls from linux box, To be executed as below from a linux box

We can keep adding url’s to url.txt. Result will be stored in validURLlist.txt

./url_check.sh < url.txt

 

 #

rm -r validURLlist.txt
while read i
do
  wget --spider $i > /dev/null 2>1
  if [ $? == 0 ]
  then
    echo "em_result:success: "$i  >> validURLlist.txt

  else
 echo "em_result:failue: "$i  >> validURLlist.txt
  fi
done 

Servlet failed with an IOException. java.io.IOException: HTTPS hostname wrong: should be

Error msg : 

Servlet failed with an IOException.java.io.IOException: HTTPS hostname wrong:  should be XXXXX

Context:

app is exclusively talking  on TLS1.2 and higher 

Solution:

Enable following params in weblogic startup:
-Dweblogic.ssl.SSLv2HelloEnabled=false -DUseSunHttpHandler=true -Dhttps.protocols=TLSv1.2

upgrade jdk to jdk 1.8_311 or higher.

restart domain.

access denied on webmethods IS page console

 problem: 

Access Denied

Services Necessary to show the Integration Server Administrator are currently unavailable on this port.

This is most likely due to port security restrictions.

If this is the only port available to access the Integration Server, contact webMethods Support.

 

Solution:

cd /***/IntegrationServer/instances/default/packages/WmRoot/config/ 

check listeners.cnf for exclude name="default"

make it include 

example : <value name="default">include</value>

also check file /******/IntegrationServer/instances/default/config/is_jaas.cnf

for corruption

restart IS.

 

READ_TIMEOUT in webserver

 Setup

Browser - webserver (ohs) - appserver (weblogic)

Situation

Getting below exception in ohs logs:

Exception type [READ_TIMEOUT] (no read after 120 seconds)

Solution

weblogic console - domain - config - JTA

changed Timeout Seconds from 30 to 3600 and restarted.