WebLogic Honeypot Study Records Rapid Exploitation Attempts Against CVE-2026-21962

Mar 25, 2026 · Original article ↗

Summary

A 12-day study of a vulnerable WebLogic honeypot recorded exploitation attempts against CVE-2026-21962 and older WebLogic flaws, alongside broad automated scanning. The authors recommend patching and restricting access to administrative interfaces.

Key points

The study collected traffic from a high-interaction Oracle WebLogic Server 14.1.1.0.0 honeypot between January 22 and February 3, 2026.
Attack attempts against unauthenticated RCE vulnerability CVE-2026-21962 began on the day public exploit code was released, according to the report.
The honeypot also recorded attempts targeting CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.
Observed activity included automated scanning, command-injection and path-traversal attempts, and probes for unrelated products and common exposed files.
The report identifies libredtail-http and the Nmap Scripting Engine among prominent tools, and says attackers often used VPS infrastructure.
The authors recommend applying Oracle security updates, restricting administrative-console and protocol access, and using filtering and monitoring to detect exploit attempts.

Article Details

Publisher: CloudSek
Report Period: 2026-01-22 to 2026-02-03
Scope: Attacks observed by a high-interaction honeypot simulating Oracle WebLogic Server v14.1.1.0.0, including WebLogic CVEs and non-WebLogic activity.
Sample Size: Not disclosed
Key Statistics: The report lists 3 unique IPs targeting CVE-2026-21962 during the 12-day collection period.
The report lists 4 unique IPs targeting CVE-2020-14882/14883, and 1 each targeting CVE-2020-2551 and CVE-2017-10271.
Generic Web Recon accounted for 967 requests from 78 unique IPs; Path Traversal accounted for 87 requests from 26 unique IPs.
The root path received 2,138 requests from 653 unique IPs.
libredtail-http generated 1,012 requests from 21 IPs, and Nmap Scripting Engine generated 664 requests from 5 IPs.
Recommendations: Apply the latest Oracle Critical Patch Updates immediately, prioritizing CVE-2026-21962.
Restrict WebLogic administrative console access to firewalls, VPNs, or internal networks.
Disable or restrict IIOP/T3 and WLS-WSAT access from untrusted networks.
Deploy WAF rules to block exploit patterns and path-traversal sequences, and use deep packet inspection or security agents for known deserialization gadget chains.
Enhance WebLogic and host monitoring for repeated exploit-path access and suspicious operating-system command execution.

Indicators of compromise

Type	Indicator	Context
IPV4	`149[.]28[.]149[.]165`	Listed among IPs attempting to exploit CVE-2026-21962.
IPV4	`162[.]211[.]230[.]179`	Sent a POST request targeting the CVE-2017-10271 WebLogic endpoint; the report describes it as an exploitation attempt.
IPV4	`195[.]184[.]76[.]253`	Listed as an attacker IP targeting CVE-2020-14882/14883.
IPV4	`212[.]113[.]98[.]30`	Listed as an attacker IP targeting CVE-2020-14882/14883.
IPV4	`41[.]251[.]179[.]181`	Listed among IPs attempting to exploit CVE-2026-21962.
IPV4	`67[.]211[.]213[.]61`	Sent repeated probing attempts targeting CVE-2020-14882/14883 and CVE-2020-2551; the report says the latter activity most likely checked for vulnerability rather than successfully exploiting it.
IPV4	`67[.]213[.]118[.]179`	Reported as the first observed exploitation attempt targeting CVE-2026-21962; source says it was also reported on AbuseIpdb.
IPV4	`91[.]196[.]152[.]131`	Listed as an attacker IP targeting CVE-2020-14882/14883.