Oracle Vulnerabilities
Oracle software listed in KEV includes Java, the WebLogic Server application platform and the E-Business Suite business applications, which receive fixes through quarterly Critical Patch Updates and, since May 2026, additional Critical Security Patch Updates between them. The database tracks 46 Oracle CVE records. CISA lists 46 of them as exploited in the wild, most recently on 2026-08-24. The most affected products are WebLogic Server, Java SE, Fusion Middleware.
Recently Exploited Oracle CVEs
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle WebLogic Server Unspecified Vulnerability
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Affected Products
17 products| Product | CVEs | KEV | Latest |
|---|---|---|---|
| WebLogic Server | 12 | 12 | 2026-06-01 |
| Java SE | 7 | 7 | 2022-03-28 |
| Fusion Middleware | 6 | 6 | 2025-11-21 |
| E-Business Suite | 4 | 4 | 2026-07-15 |
| Java Runtime Environment (JRE) | 4 | 4 | 2022-05-25 |
| Agile Product Lifecycle Management (PLM) | 2 | 2 | 2025-02-24 |
| PeopleSoft Enterprise PeopleTools | 1 | 1 | 2026-06-12 |
| ADF Faces | 1 | 1 | 2024-09-18 |
| BI Publisher (Formerly XML Publisher) | 1 | 1 | 2022-03-25 |
| HTTP Server and Oracle Weblogic Server Proxy Plug-in | 1 | 1 | 2026-08-24 |
| Intelligence Enterprise Edition | 1 | 1 | 2022-01-18 |
| Java SE and JRockit | 1 | 1 | 2023-05-12 |
| Java SE JDK and JRE | 1 | 1 | 2022-03-03 |
| Multiple Products | 1 | 1 | 2021-11-03 |
| Solaris | 1 | 1 | 2022-05-25 |
| Solaris and Zettabyte File System (ZFS) | 1 | 1 | 2021-11-03 |
| VirtualBox | 1 | 1 | 2022-03-03 |
All Oracle CVEs
46 records| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | Oracle Corporation | 10.0 | 73.2% | KEV | 2026-01-20 |
| CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management Vulnerability | Oracle Corporation | 9.8 | 0.8% | KEV | 2026-05-28 |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Oracle Corporation | 9.8 | 9.4% | KEV | 2026-06-11 |
| CVE-2024-21182 | Oracle WebLogic Server Unspecified Vulnerability | Oracle Corporation | 7.5 | 74.2% | KEV | 2024-07-16 |
| CVE-2025-61757 | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | Oracle Corporation | 9.8 | 88.6% | KEV | 2025-10-21 |
| CVE-2025-61884 | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | Oracle Corporation | 7.5 | 95.9% | KEV | 2025-10-12 |
| CVE-2025-61882 | Oracle E-Business Suite Unspecified Vulnerability | Oracle Corporation | 9.8 | 99.7% | KEV | 2025-10-05 |
| CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | Oracle Corporation | 8.8 | 3.9% | KEV | 2024-02-17 |
| CVE-2020-2883 | Oracle WebLogic Server Unspecified Vulnerability | Oracle Corporation | 9.8 | 94.9% | KEV | 2020-04-15 |
| CVE-2024-21287 | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | Oracle Corporation | 7.5 | 1.7% | KEV | 2024-11-18 |
| CVE-2020-14644 | Oracle WebLogic Server Remote Code Execution Vulnerability | Oracle Corporation | 9.8 | 94.5% | KEV | 2020-07-15 |
| CVE-2022-21445 | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | Oracle Corporation | 9.8 | 62.5% | KEV | 2022-04-19 |
| CVE-2017-3506 | Oracle WebLogic Server OS Command Injection Vulnerability | Oracle Corporation | 7.4 | 96.3% | KEV | 2017-04-24 |
| CVE-2020-2551 | Oracle Fusion Middleware Unspecified Vulnerability | Oracle Corporation | 9.8 | 93.2% | KEV | 2020-01-15 |
| CVE-2016-3427 | Oracle Java SE and JRockit Unspecified Vulnerability | - | 9.8 | 92.3% | KEV | 2016-04-21 |
| CVE-2023-21839 | Oracle WebLogic Server Unspecified Vulnerability | Oracle Corporation | 7.5 | 99.9% | KEV | 2023-01-17 |
| CVE-2022-21587 | Oracle E-Business Suite Unspecified Vulnerability | Oracle Corporation | 9.8 | 98.3% | KEV | 2022-10-18 |
| CVE-2021-35587 | Oracle Fusion Middleware Unspecified Vulnerability | Oracle Corporation | 9.8 | 96.3% | KEV | 2022-01-19 |
| CVE-2018-2628 | Oracle WebLogic Server Unspecified Vulnerability | Oracle Corporation | 9.8 | 100.0% | KEV | 2018-04-19 |
| CVE-2013-0422 | Oracle JRE Remote Code Execution Vulnerability | - | 9.8 | 97.0% | KEV | 2013-01-10 |
| CVE-2010-0840 | Oracle JRE Unspecified Vulnerability | - | 9.8 | 96.3% | KEV | 2010-04-01 |
| CVE-2013-0431 | Oracle JRE Sandbox Bypass Vulnerability | - | 3.7 | 90.1% | KEV | 2013-01-31 |
| CVE-2013-2423 | Oracle JRE Unspecified Vulnerability | - | 3.7 | 85.2% | KEV | 2013-04-17 |
| CVE-2019-3010 | Oracle Solaris Privilege Escalation Vulnerability | Oracle Corporation | 8.8 | 13.4% | KEV | 2019-10-16 |
| CVE-2012-1710 | Oracle Fusion Middleware Unspecified Vulnerability | - | 9.8 | 7.8% | KEV | 2012-05-03 |
| CVE-2013-2465 | Oracle Java SE Unspecified Vulnerability | - | 9.8 | 98.8% | KEV | 2013-06-18 |
| CVE-2012-5076 | Oracle Java SE Sandbox Bypass Vulnerability | - | 9.8 | 91.3% | KEV | 2012-10-16 |
| CVE-2012-0518 | Oracle Fusion Middleware Unspecified Vulnerability | - | 4.7 | 4.7% | KEV | 2012-10-16 |
| CVE-2019-2616 | Oracle BI Publisher Unauthorized Access Vulnerability | Oracle Corporation | 7.2 | 92.2% | KEV | 2019-04-23 |
| CVE-2012-4681 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | - | 9.8 | 98.5% | KEV | 2012-08-28 |
| CVE-2012-0507 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | - | 9.8 | 98.1% | KEV | 2012-06-07 |
| CVE-2011-3544 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | - | 9.8 | 96.7% | KEV | 2011-10-19 |
| CVE-2012-1723 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | - | 9.8 | 93.7% | KEV | 2012-06-16 |
| CVE-2015-2590 | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | - | 9.8 | 25.5% | KEV | 2015-07-16 |
| CVE-2015-4902 | Oracle Java SE Integrity Check Vulnerability | - | 5.3 | 13.6% | KEV | 2015-10-21 |
| CVE-2008-3431 | Oracle VirtualBox Insufficient Input Validation Vulnerability | - | 8.8 | 6.9% | KEV | 2008-08-05 |
| CVE-2017-10271 | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | Oracle Corporation | 7.5 | 100.0% | KEV | 2017-10-19 |
| CVE-2020-14864 | Oracle Business Intelligence Enterprise Edition Path Transversal | Oracle Corporation | 7.5 | 97.2% | KEV | 2020-10-21 |
| CVE-2019-2725 | Oracle WebLogic Server, Injection | Oracle Corporation | 7.5 | 100.0% | KEV | 2019-04-26 |
| CVE-2020-14882 | Oracle WebLogic Server Remote Code Execution Vulnerability | Oracle Corporation | 9.8 | 100.0% | KEV | 2020-10-21 |
| CVE-2020-14750 | Oracle WebLogic Server Remote Code Execution Vulnerability | Oracle Corporation | 9.8 | 99.3% | KEV | 2020-11-01 |
| CVE-2012-3152 | Oracle Fusion Middleware Unspecified Vulnerability | - | 9.1 | 98.8% | KEV | 2012-10-16 |
| CVE-2020-14883 | Oracle WebLogic Server Unspecified Vulnerability | Oracle Corporation | 7.2 | 97.9% | KEV | 2020-10-21 |
| CVE-2020-2555 | Oracle Multiple Products Remote Code Execution Vulnerability | Oracle Corporation | 9.8 | 97.1% | KEV | 2020-01-15 |
| CVE-2015-4852 | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | - | 9.8 | 96.0% | KEV | 2015-11-18 |
| CVE-2020-14871 | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | Oracle Corporation | 10.0 | 80.2% | KEV | 2020-10-21 |
Frequently Asked Questions
How many Oracle vulnerabilities are actively exploited?→
46 Oracle CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-09. The latest was added on 2026-08-24.
Which Oracle vulnerabilities are used in ransomware attacks?→
CISA marks 13 Oracle KEV entries as known to be used in ransomware campaigns, including CVE-2026-35273, CVE-2025-61884, CVE-2025-61882, CVE-2022-21587, CVE-2013-0422.
Which Oracle products have the most exploited vulnerabilities?→
- +WebLogic Server: 12 CVEs (12 in KEV)
- +Java SE: 7 CVEs (7 in KEV)
- +Fusion Middleware: 6 CVEs (6 in KEV)
- +E-Business Suite: 4 CVEs (4 in KEV)
- +Java Runtime Environment (JRE): 4 CVEs (4 in KEV)
Where does Oracle publish security advisories?→
Oracle publishes security advisories at https://www.oracle.com/security-alerts/. Check the vendor advisory for fixed versions and workarounds before applying updates.
Sources
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Vendor and product names for exploited CVEs follow the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not affiliated with or endorsed by Oracle, MITRE, CISA, or FIRST.