Tuesday, August 25, 2026

The Exploit Bulletin

3 items require action.

Affects:Oracle HTTP Server / WebLogic Server Proxy Plug-in· miniOrange SAML Single Sign On· TYPO3 extension powermail

CISA KEV · due 2026-08-27Data ExposurecriticalCVSS 10.0 CVE-2026-21962

Unauthenticated access to all data behind Oracle HTTP Server / WebLogic Proxy Plug-in (CVE-2026-21962)

CISA added this CVSS-10 flaw to KEV yesterday with an unusually short 2026-08-27 remediation deadline, and multiple outlets report it is being widely exploited — teams that leave the proxy plug-in unpatched this week should expect their WebLogic-fronted data to be accessed or tampered with.

An improper access control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in lets a remote, unauthenticated attacker read, create, modify or delete any data the proxy can reach — full compromise of confidentiality and integrity with scope change (CVSS 10.0). Public exploit code exists and exploitation has been observed since at least February.

Affected: Oracle HTTP Server / WebLogic Server Proxy Plug-in 12.2.1.4.0; Oracle HTTP Server / WebLogic Server Proxy Plug-in 14.1.1.0.0; Oracle HTTP Server / WebLogic Server Proxy Plug-in 14.1.2.0.0

How to Test

Inventory Oracle HTTP Server instances and check whether the WebLogic Server Proxy Plug-in (mod_wl) is at 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 without the January 2026 CPU applied; review OHS access logs for unauthenticated requests hitting WebLogic-proxied paths from unfamiliar IPs, and treat any anomalous access to backend admin or data endpoints via the proxy as a compromise indicator.

How to Patch

Apply the Oracle Critical Patch Update from January 2026 (cpujan2026) to all affected OHS and WebLogic Proxy Plug-in installations; if the patch cannot be applied immediately, restrict internet exposure of the proxy front-end or take the product offline per CISA's BOD 22-01 required action until patched.

Evidence: CISA KEV ↗, VulnCheck KEV ↗, CISA SSVC: active ↗, The Hacker News: actively exploited Oracle WebLogic flaw added to KEV ↗, SecurityWeek: widely exploited against WebLogic servers ↗, Public exploit ↗

Vendor Advisory: link ↗

Sources: CISA KEV ↗, The Hacker News ↗, SecurityWeek ↗

Permalink: /bulletin/2026-08-25/unauthenticated-access-to-all-data-behind-oracle-http-server-weblogic-cve-2026-21962

Authentication BypasscriticalCVSS 9.8 CVE-2026-15981 CVE-2026-61979

Two SAML signature bypasses in the miniOrange SSO plugin let anyone log in as any WordPress user (CVE-2026-15981)

Active targeting of both bypasses was reported today alongside public exploit code, and any exposed WordPress site running an unpatched edition of the plugin can be taken over as admin with a single crafted SAMLResponse.

Two independent signature-verification flaws in the miniOrange SAML Single Sign On plugin let an unauthenticated attacker submit a crafted SAMLResponse and log in as any existing WordPress user, including administrators. CVE-2026-15981 treats the -1 error return of PHP's openssl_verify() as a successful verification (CVSS 9.8); CVE-2026-61979 is a signature-algorithm confusion that accepts an HMAC-SHA1 signature computed with the public RSA key as the secret (CVSS 8.1). All seven plugin editions sold under the one WordPress slug are affected.

Affected: miniOrange SAML Single Sign On – SSO Login (WordPress plugin, slug miniorange-saml-20-single-sign-on), Free edition <= 5.4.4; Premium edition <= 13.0.3; Standard edition <= 17.0.5; Premium/Enterprise/All-Inclusive multisite edition <= 20.2.7; Enterprise/All-Inclusive edition <= 26.0.2; VIP edition <= 32.0.7; VIP multisite edition <= 35.0.6

How to Test

Confirm the plugin edition and version (slug miniorange-saml-20-single-sign-on) against the fixed versions below; on sites that ran a vulnerable version, review web server logs for POSTs to the plugin's SAML ACS endpoint carrying SAMLResponse parameters that have no corresponding authentication event in your IdP logs, and audit WordPress user sessions and newly created or modified admin accounts.

How to Patch

Update to the fixed release for your edition — Free 5.4.5, Premium 13.0.4, Standard 17.0.6, Premium/Enterprise/All-Inclusive multisite 20.2.8, Enterprise/All-Inclusive 26.0.3, VIP 32.0.8, VIP multisite 35.0.7 (the Free fix is changeset 3611421, strict handling of openssl_verify return values); until updated, disable the plugin or block the SAML ACS endpoint at the web server, then rotate admin credentials on any site exposed while vulnerable.

Evidence: VulnCheck KEV ↗, Patchstack/DigitalOcean analysis claiming in-the-wild exploitation ↗, Public exploit ↗, Patchstack vulnerability database entry with patched version 5.4.4 ↗

Vendor Advisory: link 1 ↗, link 2 ↗, link 3 ↗, link 4 ↗, link 5 ↗, link 6 ↗

Sources: SecurityWeek ↗, The Hacker News ↗

Permalink: /bulletin/2026-08-25/two-saml-signature-bypasses-in-the-miniorange-sso-plugin-let-anyone-cve-2026-15981

Remote Code ExecutioncriticalCVSS 9.5 CVE-2026-77136

Unauthenticated Fluid template injection in TYPO3 powermail forms enables RCE (CVE-2026-77136)

The TYPO3 security team's advisory published today confirms active in-the-wild exploitation and urges immediate updates — sites leaving a public Powermail contact form unpatched this week face secrets disclosure and likely server compromise.

The TYPO3 powermail extension renders the raw value of a form field configured as the sender name as a Fluid template, so an anonymous visitor submitting a normal contact form can execute arbitrary Fluid ViewHelpers — disclosing server configuration, environment variables and source code, and potentially achieving remote code execution. The vulnerable sender_name configuration is common and default-adjacent.

Affected: TYPO3 extension powermail < 10.9.3; TYPO3 extension powermail >= 11.0.0, < 12.6.1; TYPO3 extension powermail >= 13.0.0, < 13.2.1

How to Test

Search the tx_powermail_domain_model_mail database table and received form notification emails for Fluid syntax in the sender_name field — strings like 'f:', 'v:' or 'namespace' indicate attempted or successful ViewHelper execution; per the advisory, treat any system with such entries as potentially compromised and investigate before simply patching.

How to Patch

Update powermail to 10.9.3, 12.6.1 or 13.2.1 via the TYPO3 extension manager, Packagist or the extensions.typo3.org downloads; if you cannot update immediately, remove or reconfigure the sender_name field mapping on public forms as an interim mitigation, and rotate exposed environment secrets on any site showing Fluid syntax in stored submissions.

Evidence: VulnCheck KEV ↗, Vendor confirmed ↗

Vendor Advisory: link ↗

Sources: VulnCheck KEV ↗, NVD ↗

Permalink: /bulletin/2026-08-25/unauthenticated-fluid-template-injection-in-typo3-powermail-forms-cve-2026-77136

← Previous Edition Archive Next Edition →