Header Spoofing Detection

Aitor Fernández@aitorsbio

•updated Mar 26, 2026•8•0•128

Detects attempts to exploit CVE-2026-21962, a header spoofing vulnerability in Oracle WebLogic Server. The rule identifies suspicious requests where 'wl-proxy-client-ip' or 'x-forwarded-for' headers contain localhost/loopback addresses or command injection keywords, combined with URI paths related to 'weblogic' or 'proxy'.