Oracle vulnerabilities attackers have used

Every Oracle entry in CISA KEV

1. CVE-2026-21962

   Added Aug 24, 2026 · due Aug 27, 2026

   Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

   Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to…

2. CVE-2026-46817

   Added Jul 15, 2026 · due Jul 18, 2026

   Oracle E-Business Suite Improper Privilege Management Vulnerability

   Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in…

3. CVE-2026-35273

   RansomwareAdded Jun 12, 2026 · due Jun 15, 2026

   Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

   Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.

4. CVE-2024-21182

   Added Jun 1, 2026 · due Jun 4, 2026

   Oracle WebLogic Server Unspecified Vulnerability

   Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized…

5. CVE-2025-61757

   Added Nov 21, 2025 · due Dec 12, 2025

   Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

   Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

6. CVE-2025-61884

   RansomwareAdded Oct 20, 2025 · due Nov 10, 2025

   Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

   Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

7. CVE-2025-61882

   RansomwareAdded Oct 6, 2025 · due Oct 27, 2025

   Oracle E-Business Suite Unspecified Vulnerability

   Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful…

8. CVE-2024-20953

   Added Feb 24, 2025 · due Mar 17, 2025

   Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

   Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

9. CVE-2020-2883

   Added Jan 7, 2025 · due Jan 28, 2025

   Oracle WebLogic Server Unspecified Vulnerability

   Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.

10. CVE-2024-21287

    Added Nov 21, 2024 · due Dec 12, 2024

    Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

    Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in…

11. CVE-2022-21445

    Added Sep 18, 2024 · due Oct 9, 2024

    Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

    Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.

12. CVE-2020-14644

    Added Sep 18, 2024 · due Oct 9, 2024

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.

13. CVE-2017-3506

    Added Jun 3, 2024 · due Jun 24, 2024

    Oracle WebLogic Server OS Command Injection Vulnerability

    Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML…

14. CVE-2020-2551

    Added Nov 16, 2023 · due Dec 7, 2023

    Oracle Fusion Middleware Unspecified Vulnerability

    Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.

15. CVE-2016-3427

    Added May 12, 2023 · due Jun 2, 2023

    Oracle Java SE and JRockit Unspecified Vulnerability

    Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be…

16. CVE-2023-21839

    Added May 1, 2023 · due May 22, 2023

    Oracle WebLogic Server Unspecified Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.

17. CVE-2022-21587

    RansomwareAdded Feb 2, 2023 · due Feb 23, 2023

    Oracle E-Business Suite Unspecified Vulnerability

    Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

18. CVE-2021-35587

    Added Nov 28, 2022 · due Dec 19, 2022

    Oracle Fusion Middleware Unspecified Vulnerability

    Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

19. CVE-2018-2628

    Added Sep 8, 2022 · due Sep 29, 2022

    Oracle WebLogic Server Unspecified Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

20. CVE-2019-3010

    Added May 25, 2022 · due Jun 15, 2022

    Oracle Solaris Privilege Escalation Vulnerability

    Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.

21. CVE-2013-2423

    Added May 25, 2022 · due Jun 15, 2022

    Oracle JRE Unspecified Vulnerability

    Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.

22. CVE-2013-0431

    RansomwareAdded May 25, 2022 · due Jun 15, 2022

    Oracle JRE Sandbox Bypass Vulnerability

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.

23. CVE-2013-0422

    RansomwareAdded May 25, 2022 · due Jun 15, 2022

    Oracle JRE Remote Code Execution Vulnerability

    A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.

24. CVE-2012-1710

    RansomwareAdded May 25, 2022 · due Jun 15, 2022

    Oracle Fusion Middleware Unspecified Vulnerability

    Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.

25. CVE-2010-0840

    Added May 25, 2022 · due Jun 15, 2022

    Oracle JRE Unspecified Vulnerability

    Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.

26. CVE-2013-2465

    RansomwareAdded Mar 28, 2022 · due Apr 18, 2022

    Oracle Java SE Unspecified Vulnerability

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D

27. CVE-2012-5076

    Added Mar 28, 2022 · due Apr 18, 2022

    Oracle Java SE Sandbox Bypass Vulnerability

    The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox…

28. CVE-2012-0518

    Added Mar 28, 2022 · due Apr 18, 2022

    Oracle Fusion Middleware Unspecified Vulnerability

    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors

29. CVE-2019-2616

    Added Mar 25, 2022 · due Apr 15, 2022

    Oracle BI Publisher Unauthorized Access Vulnerability

    Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.

30. CVE-2015-4902

    Added Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE Integrity Check Vulnerability

    Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.

31. CVE-2015-2590

    Added Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

    An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.

32. CVE-2012-4681

    RansomwareAdded Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

33. CVE-2012-1723

    RansomwareAdded Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.

34. CVE-2012-0507

    RansomwareAdded Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

35. CVE-2011-3544

    Added Mar 3, 2022 · due Mar 24, 2022

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

36. CVE-2008-3431

    Added Mar 3, 2022 · due Mar 24, 2022

    Oracle VirtualBox Insufficient Input Validation Vulnerability

    An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.

37. CVE-2017-10271

    RansomwareAdded Feb 10, 2022 · due Aug 10, 2022

    Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

    Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.

38. CVE-2020-14864

    Added Jan 18, 2022 · due Jul 18, 2022

    Oracle Business Intelligence Enterprise Edition Path Transversal

    Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

39. CVE-2019-2725

    RansomwareAdded Jan 10, 2022 · due Jul 10, 2022

    Oracle WebLogic Server, Injection

    Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

40. CVE-2020-2555

    Added Nov 3, 2021 · due May 3, 2022

    Oracle Multiple Products Remote Code Execution Vulnerability

    Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion…

41. CVE-2020-14883

    Added Nov 3, 2021 · due May 3, 2022

    Oracle WebLogic Server Unspecified Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.

42. CVE-2020-14882

    Added Nov 3, 2021 · due May 3, 2022

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.

43. CVE-2020-14871

    Added Nov 3, 2021 · due May 3, 2022

    Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

    Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.

44. CVE-2020-14750

    Added Nov 3, 2021 · due May 3, 2022

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.

45. CVE-2015-4852

    Added Nov 3, 2021 · due May 3, 2022

    Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

    Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.

46. CVE-2012-3152

    Added Nov 3, 2021 · due May 3, 2022

    Oracle Fusion Middleware Unspecified Vulnerability

    Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.

Related

• All vendors in CISA KEV

  Ranked by how many exploited vulnerabilities each has.

• Latest CVEs this week

  Critical and High CVEs from the last 7 days, with KEV and EPSS.

• Vulnerability watch

  A briefing and a fix pull request when an advisory hits your dependencies.