CISA Adds Oracle WebLogic Proxy Plug-in Flaw CVE-2026-21962 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a vulnerability in the Oracle WebLogic Server Proxy Plug-in (mod_wl_ohs) is being actively exploited in the wild.
On August 24, 2026, CISA added the access-control flaw tracked as CVE-2026-21962 to its Known Exploited Vulnerabilities (KEV) catalog. The affected module enables web servers to proxy requests to Oracle WebLogic Server and is distributed with Oracle HTTP Server.
Equivalent plug-ins for Apache HTTP Server and IIS are also impacted. The vulnerability can be exploited remotely without authentication, allowing attackers to modify or delete data, inject malicious content, and leak sensitive information from the web server and any connected backend systems.
Security researchers note that successful exploitation could grant attackers broad control over proxied resources and potentially pivot into Oracle WebLogic environments. Organizations are urged to apply available mitigations or disable the plug-in where possible until patches are deployed.
Related articles
Sky Discloses Five Vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Sky has released a security advisory detailing five vulnerabilities affecting its IT asset management tools SKYSEA Client View and SKYMEC IT Manager. The flaws impact all Windows-based components including master servers, management machines, terminal machines, and standalone terminals. Two issues received CVSSv4 base scores of 8.5 while the remaining three scored 5.8, with CVSSv3 scores reversing the severity ranking for some entries. The vulnerabilities include missing authorization checks, improper file permissions during installation, multiple path traversal flaws, and a stack-based buffer overflow. Sky has made update and patch modules available to contracted customers and strongly recommends immediate deployment.
Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations
A high-severity vulnerability in Zoom Workplace clients across Windows, Mac, iOS, Android, and Linux allows attackers to remotely seize full device control simply by having a victim enable screen sharing and the annotation tool. The flaw requires no user interaction such as clicking links or dismissing warnings, and the compromise occurs silently without visible alerts. Security researchers demonstrated that AI tools enabled complete exploit development within 24 hours, dramatically lowering the barrier for advanced attacks previously limited to nation-state actors. The issue affects hundreds of millions of remote workers who rely on Zoom’s daily screen-sharing features. Official patches have been released, and users are urged to update immediately while avoiding annotation tools in sensitive sessions. Apple simultaneously addressed related macOS flaws in multiple versions. The incident highlights how generative AI is accelerating the weaponization of vulnerabilities.
Windows 11 May Silently Remove Discrete GPU Drivers Due to Eco Mode on Gaming Laptops
Windows 11 has introduced an unexpected behavior that can delete drivers for discrete graphics cards on gaming laptops when the device remains powered off for an extended period in Eco Mode. The issue was first reported by the owner of an Asus ROG Zephyrus G14 equipped with a mobile GeForce RTX 5070 Ti, where the system treated the physically disconnected GPU as permanently removed after 15 days. Windows component pnpclean.dll then purged both the device entry and the associated Nvidia driver package, leaving the laptop with only a Microsoft Basic Display Adapter reporting error code 10. The default cleanup timer is normally 30 days, but it can be shorter for certain hardware configurations that fully disconnect discrete graphics for power saving. Similar incidents have been observed on older Asus ROG models with AMD Radeon GPUs, prompting the developer of G-Helper to add a warning to the utility. Users can mitigate the problem by periodically switching to Standard Mode or by disabling automatic driver package cleanup via a specific PowerShell command that sets the Autorun value to 0 under the Device Driver Packages registry key. Microsoft has not yet issued an official statement on the matter.
CISA Adds Actively Exploited Zimbra CVE-2026-73570 to KEV Catalog with Immediate Patching Deadline
CISA has added CVE-2026-73570 affecting Zimbra Collaboration Suite to its Known Exploited Vulnerabilities catalog, ordering urgent remediation due to confirmed active exploitation. The flaw enables unauthenticated remote command execution on servers where the optional zimbra-snmp package is installed and SNMP notifications are enabled. Exploitation occurs via specially crafted SMTP requests that trigger operating system command injection under the privileges of the zimbra user. Zimbra released the fix in version 10.1.20 on July 20, 2026, while CISA placed the vulnerability in the KEV list on August 21 and set an August 24 deadline for federal civilian agencies. Organizations are advised to first verify exposure by checking for zimbra-snmp and SNMP notification settings before applying the update. Post-patch steps include validating the version, controlled service restarts, and hunting for indicators such as unexpected Zimbra restarts, anomalous zimbra user activity, and new files in sensitive directories like /opt/zimbra/jetty/webapps/. The directive highlights the critical nature of pre-authentication flaws in internet-facing mail servers that process untrusted inbound traffic.