CVE-2026-21962

 As part of Oracle's January 2026 Critical Patch Update (CPU), CVE-2026-21962 has been identified as a Critical vulnerability (CVSS 10.0) affecting the Oracle WebLogic Server Proxy Plug-in running on Oracle HTTP Server (Apache).

 httpd.conf

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block dot-dot-slash and traversal patterns in raw and decoded URIs
    RewriteCond %{THE_REQUEST} (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|%2e%2e%5c|%2e%2e\\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
    # Block direct or nested access to administrative/internal consoles
    RewriteCond %{REQUEST_URI} ^/(console|consolehelp|em|management|bea_wls_internal|bea_wls_management_internal) [NC,OR]
    RewriteCond %{THE_REQUEST} /(console|consolehelp|em|management|bea_wls_internal|bea_wls_management_internal) [NC]
    RewriteRule .* - [F,L]
    # Block access to WebLogic Web Services Test client or internal utilities
    RewriteCond %{REQUEST_URI} ^/ws_utc [NC]
    RewriteRule .* - [F,L]
</IfModule>

 

<IfModule mod_headers.c> 
# Strip client-supplied proxy control headers before forwarding
RequestHeader unset WL-Proxy-SSL
RequestHeader unset WL-Proxy-Client-IP 
RequestHeader unset X-WebLogic-Request-Type
RequestHeader unset X-WebLogic-KeepAliveSecs 
RequestHeader unset X-Forwarded-For-Original 
</IfModule>

 

mod_wl_ohs.conf

# Restrict unauthenticated administrative path routing explicitly
<LocationMatch "^/(console|consolehelp|em|management|bea_wls_internal)($|/.*)">
SetHandler default-handler
Require all denied
</LocationMatch>