WebLogic Exploitation and RCE Activity (CVE-2026-21962)

Daniel Jeremiah@daniyyell

•updated Mar 27, 2026•1•414

Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.