Odd WebLogic Request. Possible CVE-2026-21962 Exploit Attempt or AI Slop?
Source: SANS Internet Storm Center
I was looking for possible exploitation of CVE-2026-21962, a recently patched WebLogic vulnerability. While searching for related exploit attempts in our data, I encountered the following request:
1
2
3
4
5
6
7
8
9
GET /weblogic//weblogic/..;/bea_wls_internal/ProxyServlet
host: 71.126.165.182
user-agent: Mozilla/5.0 (compatible; Exploit/1.0)
accept-encoding: gzip, deflate
accept: */*
connection: close
wl-proxy-client-ip: 127.0.0.1;Y21kOndob2FtaQ==
proxy-client-ip: 127.0.0.1;Y21kOndob2FtaQ==
x-forwarded-for: 127.0.0.1;Y21kOndob2FtaQ==
According to write-ups about CVE-2026-21962, this request is relevant. The vulnerability also matched an earlier “AI Slop” Proof of Concept (PoC). Another write-up suggests a different exploit mechanism that does not align with the request above.
The source IP is 193[.]24.123.42, which seems to be located in Russia. There have been sporadic HTTP scans from this address, and it has previously used the “Claudbot” user-agent.
The exploit appears unusual, utilizing the loopback address as an “X-Forwarded-For” address. This is a common tactic to bypass access restrictions. Instead of a semicolon, IPs should be delimited by a comma. The base64 encoded string decodes to: “cmd:whoami”, suggesting a potential command injection vulnerability. There is a peculiar mix of encodings in one header, making it unlikely to succeed.
We noted a significant increase in requests, including the wl-proxy-client-ip header, starting January 21st, although this header has a history of use. This behavior could be an exploit that AI might generate, given terms like “WebLogic Server Proxy Plug-in”.
I consulted ChatGPT and Grok regarding whether this is an exploit or AI slop. ChatGPT suggested that this resembles a scanner or probe designed to mimic an exploit, while Grok asserted that it is indeed an actual exploit attempt targeting a well-known vulnerability in Oracle WebLogic Server.
To read the complete article, visit: SANS Internet Storm Center