[Under Evaluation – CVE-2026-21962]: Improper access control in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in allows unauthenticated HTTP network attackers to gain unauthorized access to instances and create/delete/modify critical data. Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0. Apply Oracle’s January 2026 patches and restrict external HTTP exposure to these components.