Oracle known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities catalog lists 46 Oracle vulnerabilities: 5 added in the last 365 days, 29 rated critical (CVSS 9 or higher), and 13 with known ransomware use. The most recent was added Aug 24, 2026.

RSS feed for Oracle exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant

Added to KEV	CVE	Vulnerability	CVSS	EPSS	Federal due date	Ransomware use
2026-08-24	CVE-2026-21962	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability	10 (v3.1)	73.2%	2026-08-27	Unknown
2026-07-15	CVE-2026-46817	Oracle E-Business Suite Improper Privilege Management Vulnerability	9.8 (v3.1)	12.3%	2026-07-18	Unknown
2026-06-12	CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability	9.8 (v3.1)	96.7%	2026-06-15	Known
2026-06-01	CVE-2024-21182	Oracle WebLogic Server Unspecified Vulnerability	7.5 (v3.1)	74.2%	2026-06-04	Unknown
2025-11-21	CVE-2025-61757	Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability	9.8 (v3.1)	88.6%	2025-12-12	Unknown
2025-10-20	CVE-2025-61884	Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability	7.5 (v3.1)	95.9%	2025-11-10	Known
2025-10-06	CVE-2025-61882	Oracle E-Business Suite Unspecified Vulnerability	9.8 (v3.1)	99.7%	2025-10-27	Known
2025-02-24	CVE-2024-20953	Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability	8.8 (v3.1)	3.9%	2025-03-17	Unknown
2025-01-07	CVE-2020-2883	Oracle WebLogic Server Unspecified Vulnerability	9.8 (v3.0)	94.6%	2025-01-28	Unknown
2024-11-21	CVE-2024-21287	Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability	7.5 (v3.1)	1.7%	2024-12-12	Unknown
2024-09-18	CVE-2020-14644	Oracle WebLogic Server Remote Code Execution Vulnerability	9.8 (v3.1)	94.5%	2024-10-09	Unknown
2024-09-18	CVE-2022-21445	Oracle ADF Faces Deserialization of Untrusted Data Vulnerability	9.8 (v3.1)	62.5%	2024-10-09	Unknown
2024-06-03	CVE-2017-3506	Oracle WebLogic Server OS Command Injection Vulnerability	7.4 (v3.1)	96.0%	2024-06-24	Unknown
2023-11-16	CVE-2020-2551	Oracle Fusion Middleware Unspecified Vulnerability	9.8 (v3.0)	92.8%	2023-12-07	Unknown
2023-05-12	CVE-2016-3427	Oracle Java SE and JRockit Unspecified Vulnerability	9.8 (v3.1)	92.3%	2023-06-02	Unknown
2023-05-01	CVE-2023-21839	Oracle WebLogic Server Unspecified Vulnerability	7.5 (v3.1)	>99.9%	2023-05-22	Unknown
2023-02-02	CVE-2022-21587	Oracle E-Business Suite Unspecified Vulnerability	9.8 (v3.1)	98.3%	2023-02-23	Known
2022-11-28	CVE-2021-35587	Oracle Fusion Middleware Unspecified Vulnerability	9.8 (v3.1)	96.3%	2022-12-19	Unknown
2022-09-08	CVE-2018-2628	Oracle WebLogic Server Unspecified Vulnerability	9.8 (v3.1)	>99.9%	2022-09-29	Unknown
2022-05-25	CVE-2010-0840	Oracle JRE Unspecified Vulnerability	9.8 (v3.1)	96.3%	2022-06-15	Unknown
2022-05-25	CVE-2012-1710	Oracle Fusion Middleware Unspecified Vulnerability	9.8 (v3.1)	7.8%	2022-06-15	Known
2022-05-25	CVE-2013-0422	Oracle JRE Remote Code Execution Vulnerability	9.8 (v3.1)	97.0%	2022-06-15	Known
2022-05-25	CVE-2013-0431	Oracle JRE Sandbox Bypass Vulnerability	3.7 (v3.1)	90.1%	2022-06-15	Known
2022-05-25	CVE-2013-2423	Oracle JRE Unspecified Vulnerability	3.7 (v3.1)	85.2%	2022-06-15	Unknown
2022-05-25	CVE-2019-3010	Oracle Solaris Privilege Escalation Vulnerability	8.8 (v3.1)	13.4%	2022-06-15	Unknown
2022-03-28	CVE-2012-0518	Oracle Fusion Middleware Unspecified Vulnerability	4.7 (v3.1)	4.7%	2022-04-18	Unknown
2022-03-28	CVE-2012-5076	Oracle Java SE Sandbox Bypass Vulnerability	9.8 (v3.1)	91.3%	2022-04-18	Unknown
2022-03-28	CVE-2013-2465	Oracle Java SE Unspecified Vulnerability	9.8 (v3.1)	98.8%	2022-04-18	Known
2022-03-25	CVE-2019-2616	Oracle BI Publisher Unauthorized Access Vulnerability	7.2 (v3.1)	92.2%	2022-04-15	Unknown
2022-03-03	CVE-2008-3431	Oracle VirtualBox Insufficient Input Validation Vulnerability	8.8 (v3.1)	6.9%	2022-03-24	Unknown
2022-03-03	CVE-2011-3544	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	9.8 (v3.1)	96.7%	2022-03-24	Unknown
2022-03-03	CVE-2012-0507	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	9.8 (v3.1)	98.2%	2022-03-24	Known
2022-03-03	CVE-2012-1723	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	9.8 (v3.1)	93.6%	2022-03-24	Known
2022-03-03	CVE-2012-4681	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability	9.8 (v3.1)	98.5%	2022-03-24	Known
2022-03-03	CVE-2015-2590	Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability	9.8 (v3.1)	25.5%	2022-03-24	Unknown
2022-03-03	CVE-2015-4902	Oracle Java SE Integrity Check Vulnerability	5.3 (v3.1)	13.6%	2022-03-24	Unknown
2022-02-10	CVE-2017-10271	Oracle Corporation WebLogic Server Remote Code Execution Vulnerability	7.5 (v3.1)	>99.9%	2022-08-10	Known
2022-01-18	CVE-2020-14864	Oracle Business Intelligence Enterprise Edition Path Transversal	7.5 (v3.1)	97.2%	2022-07-18	Unknown
2022-01-10	CVE-2019-2725	Oracle WebLogic Server, Injection	7.5 (v3.0)	>99.9%	2022-07-10	Known
2021-11-03	CVE-2012-3152	Oracle Fusion Middleware Unspecified Vulnerability	9.1 (v3.1)	98.8%	2022-05-03	Unknown
2021-11-03	CVE-2015-4852	Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability	9.8 (v3.1)	95.0%	2022-05-03	Unknown
2021-11-03	CVE-2020-14750	Oracle WebLogic Server Remote Code Execution Vulnerability	9.8 (v3.1)	99.2%	2022-05-03	Unknown
2021-11-03	CVE-2020-14871	Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability	10 (v3.1)	80.2%	2022-05-03	Unknown
2021-11-03	CVE-2020-14882	Oracle WebLogic Server Remote Code Execution Vulnerability	9.8 (v3.1)	>99.9%	2022-05-03	Unknown
2021-11-03	CVE-2020-14883	Oracle WebLogic Server Unspecified Vulnerability	7.2 (v3.1)	97.7%	2022-05-03	Unknown
2021-11-03	CVE-2020-2555	Oracle Multiple Products Remote Code Execution Vulnerability	9.8 (v3.0)	97.1%	2022-05-03	Unknown