Cyberfeed6 › Vendors › Oracle
CISA lists 46 Oracle vulnerabilities as exploited in real attacks, and 13 of them are known to be used in ransomware campaigns. Most entries concern WebLogic Server, Java SE, Fusion Middleware, E-Business Suite.
Showing the 40 most recently added of 46. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | HTTP Server and Oracle Weblogic Server Proxy Plug-in | 2026-08-24 | Critical (10.0) | No | Vendor notice |
| CVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability | E-Business Suite | 2026-07-15 | Critical (9.8) | No | Vendor notice |
| CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | PeopleSoft Enterprise PeopleTools | 2026-06-12 | Critical (9.8) | Yes | Vendor notice |
| CVE-2024-21182Oracle WebLogic Server Unspecified Vulnerability | WebLogic Server | 2026-06-01 | High (7.5) | No | Vendor notice |
| CVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | Fusion Middleware | 2025-11-21 | Critical (9.8) | No | Vendor notice |
| CVE-2025-61884Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | E-Business Suite | 2025-10-20 | High (7.5) | Yes | Vendor notice |
| CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability | E-Business Suite | 2025-10-06 | Critical (9.8) | Yes | Vendor notice |
| CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | Agile Product Lifecycle Management (PLM) | 2025-02-24 | High (8.8) | No | Vendor notice |
| CVE-2020-2883Oracle WebLogic Server Unspecified Vulnerability | WebLogic Server | 2025-01-07 | Critical (9.8) | No | Vendor notice |
| CVE-2024-21287Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | Agile Product Lifecycle Management (PLM) | 2024-11-21 | High (7.5) | No | Vendor notice |
| CVE-2022-21445Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | ADF Faces | 2024-09-18 | Critical (9.8) | No | Vendor notice |
| CVE-2020-14644Oracle WebLogic Server Remote Code Execution Vulnerability | WebLogic Server | 2024-09-18 | Critical (9.8) | No | Vendor notice |
| CVE-2017-3506Oracle WebLogic Server OS Command Injection Vulnerability | WebLogic Server | 2024-06-03 | High (7.4) | No | Vendor notice |
| CVE-2020-2551Oracle Fusion Middleware Unspecified Vulnerability | Fusion Middleware | 2023-11-16 | Critical (9.8) | No | Vendor notice |
| CVE-2016-3427Oracle Java SE and JRockit Unspecified Vulnerability | Java SE and JRockit | 2023-05-12 | Critical (9.8) | No | Vendor notice |
| CVE-2023-21839Oracle WebLogic Server Unspecified Vulnerability | WebLogic Server | 2023-05-01 | High (7.5) | No | Vendor notice |
| CVE-2022-21587Oracle E-Business Suite Unspecified Vulnerability | E-Business Suite | 2023-02-02 | Critical (9.8) | Yes | Vendor notice |
| CVE-2021-35587Oracle Fusion Middleware Unspecified Vulnerability | Fusion Middleware | 2022-11-28 | Critical (9.8) | No | Vendor notice |
| CVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability | WebLogic Server | 2022-09-08 | Critical (9.8) | No | Vendor notice |
| CVE-2019-3010Oracle Solaris Privilege Escalation Vulnerability | Solaris | 2022-05-25 | High (8.8) | No | |
| CVE-2013-2423Oracle JRE Unspecified Vulnerability | Java Runtime Environment (JRE) | 2022-05-25 | Low (3.7) | No | |
| CVE-2013-0431Oracle JRE Sandbox Bypass Vulnerability | Java Runtime Environment (JRE) | 2022-05-25 | Low (3.7) | Yes | |
| CVE-2013-0422Oracle JRE Remote Code Execution Vulnerability | Java Runtime Environment (JRE) | 2022-05-25 | Critical (9.8) | Yes | |
| CVE-2012-1710Oracle Fusion Middleware Unspecified Vulnerability | Fusion Middleware | 2022-05-25 | Critical (9.8) | Yes | |
| CVE-2010-0840Oracle JRE Unspecified Vulnerability | Java Runtime Environment (JRE) | 2022-05-25 | Critical (9.8) | No | |
| CVE-2013-2465Oracle Java SE Unspecified Vulnerability | Java SE | 2022-03-28 | Critical (9.8) | Yes | |
| CVE-2012-5076Oracle Java SE Sandbox Bypass Vulnerability | Java SE | 2022-03-28 | Critical (9.8) | No | |
| CVE-2012-0518Oracle Fusion Middleware Unspecified Vulnerability | Fusion Middleware | 2022-03-28 | Medium (4.7) | No | |
| CVE-2019-2616Oracle BI Publisher Unauthorized Access Vulnerability | BI Publisher (Formerly XML Publisher) | 2022-03-25 | High (7.2) | No | |
| CVE-2015-4902Oracle Java SE Integrity Check Vulnerability | Java SE | 2022-03-03 | Medium (5.3) | No | |
| CVE-2015-2590Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | Java SE | 2022-03-03 | Critical (9.8) | No | |
| CVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Java SE | 2022-03-03 | Critical (9.8) | Yes | |
| CVE-2012-1723Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Java SE | 2022-03-03 | Critical (9.8) | Yes | |
| CVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Java SE | 2022-03-03 | Critical (9.8) | Yes | |
| CVE-2011-3544Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Java SE JDK and JRE | 2022-03-03 | Critical (9.8) | No | |
| CVE-2008-3431Oracle VirtualBox Insufficient Input Validation Vulnerability | VirtualBox | 2022-03-03 | High (8.8) | No | |
| CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | WebLogic Server | 2022-02-10 | High (7.5) | Yes | |
| CVE-2020-14864Oracle Business Intelligence Enterprise Edition Path Transversal | Intelligence Enterprise Edition | 2022-01-18 | High (7.5) | No | |
| CVE-2019-2725Oracle WebLogic Server, Injection | WebLogic Server | 2022-01-10 | High (7.5) | Yes | |
| CVE-2020-2555Oracle Multiple Products Remote Code Execution Vulnerability | Multiple Products | 2021-11-03 | Critical (9.8) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.