Two recent high-severity disclosures highlight this ongoing challenge: an unpatched flaw in Calix residential routers allowing NAT bypass, and an actively exploited maximum-severity vulnerability in Oracle HTTP and WebLogic Servers. These weaknesses present direct vectors for unauthenticated remote compromise, enabling data exfiltration, system manipulation, and persistent unauthorized network access.
Technical Mechanism & Architectural Implications
The Calix GS7 XGS (GS5239XG) residential router suffers from an unpatched vulnerability, tracked as CVE-2026-75501. This flaw allows remote, unauthenticated attackers to program new port-forwarding rules directly on the device. Successful exploitation effectively bypasses Network Address Translation (NAT), exposing internal network devices to the public internet without user consent or authentication. This directly compromises network segmentation and perimeter defense.
Concurrently, a critical improper access control vulnerability, CVE-2026-21962, impacts Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Rated with a CVSS score of 10.0, this flaw permits an unauthenticated attacker with network access via HTTP to compromise the affected servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Exploitation enables unauthorized access to instances or modification of critical data.
| Feature | Calix GS7 XGS Vulnerability (CVE-2026-75501) | Oracle WebLogic/HTTP Server Vulnerability (CVE-2026-21962) |
|---|---|---|
| Affected Product | Calix GS7 XGS (GS5239XG) residential routers | Oracle HTTP Server, Oracle WebLogic Server Proxy Plug-in |
| Vulnerability Type | Port-forwarding rule creation (unauthenticated) | Improper Access Control |
| Attack Vector | Remote, Unauthenticated via network | Remote, Unauthenticated via HTTP network access |
| Impact | NAT bypass, internal device exposure to public internet | Unauthorized access to instances, critical data modification |
| CVSS Score | (Not specified, but critical due to unauthenticated remote access) | 10.0 (Maximum Severity) |
| Exploitation Status | Unpatched, but remote exploitation potential is clear. | Actively exploited; listed in CISA KEV catalog |
| Mitigation | No official patch; temporary measures like restricting router access. | Immediate patching is critical, CISA mandates patching for federal agencies. |
Implementation Considerations
For network administrators overseeing Calix GS7 XGS deployments, the absence of an official patch for CVE-2026-75501 necessitates immediate, granular firewall rule implementation and continuous monitoring to restrict WAN-side access to router management interfaces. Temporary mitigations may include isolating these routers on a segmented network or implementing advanced intrusion detection/prevention systems at the perimeter.
Organizations running Oracle HTTP Server or WebLogic Server Proxy Plug-in must prioritize immediate patching for CVE-2026-21962. CISA’s inclusion in the KEV catalog underscores the imperative for swift action, as federal agencies are mandated to remediate KEVs within specific timelines. The nature of these vulnerabilities, involving unauthenticated remote access, highlights the critical need for robust patch management and stringent access control policies across all network-facing infrastructure.
KEY TAKEAWAYS
- The Calix GS7 XGS router vulnerability (CVE-2026-75501) enables unauthenticated remote attackers to bypass NAT by creating arbitrary port-forwarding rules, directly exposing internal network devices.
- Oracle HTTP/WebLogic Server’s maximum-severity flaw (CVE-2026-21962, CVSS 10.0) allows unauthenticated remote compromise, leading to unauthorized data access and modification.
- Both vulnerabilities underscore the critical importance of continuous vulnerability management, especially for network edge devices and internet-facing application servers.
- Organizations must implement robust patch management processes and consider comprehensive network segmentation to mitigate the risk posed by such high-impact, actively exploited flaws.