FastSearch for CVE-2026-21962 hunt
This rule detects attempts to exploit CVE-2026-21962, a vulnerability in Oracle WebLogic Server. It specifically looks for requests to Application Gateway or Frontdoor logs that contain 'weblogic' in the URI, along with path traversal indicators ('..;', '%2e%2e') or specific proxy paths ('/_proxy/', '/wl_proxy/'), and keywords like 'proxyservlet' or 'bea_wls_internal'. These patterns are indicative of attempts to bypass security controls and access internal resources within a WebLogic environment.
Microsoft Sentinel (KQL)
