Executive Summary
This report details findings from a high-interaction honeypot simulating Oracle WebLogic Server v14.1.1.0.0, which observed immediate exploitation of CVE-2026-21962 (CVSS 10.0) following public exploit release in early 2026. Threat actors are rapidly weaponizing this unauthenticated Remote Code Execution (RCE) flaw to gain full host control.
Beyond the new zero-day-like activity, the data confirms that legacy vulnerabilities including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271 remain primary targets for automated scanning. Attackers are primarily utilizing VPS infrastructure from providers like DigitalOcean and HOSTGLOBAL.PLUS to conduct high-volume 'spray and pray' operations against WebLogic administrative consoles and protocols like IIOP and WLS-WSAT.