Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Oracle: actively exploited vulnerabilities

46 vulnerabilities in Oracle products (WebLogic Server, Java SE (JRE / JDK), E-Business Suite…) are in CISA’s catalog of exploited vulnerabilities, 2 of them added in the last 90 days. Last added: August 24, 2026.

Oracle security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Oracle category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single Oracle product (WebLogic Server, Java SE (JRE / JDK)…) rather than the whole brand.

  • WebLogic Server14 vulnerabilities, Web servers
  • Java SE (JRE / JDK)13 vulnerabilities, Frameworks
  • E-Business Suite4 vulnerabilities, Business apps and data
  • Identity and Access Management (OIM / OAM)3 vulnerabilities, Identity and access
  • Agile PLM2 vulnerabilities, Business apps and data
  • Business Intelligence (OBIEE / BI Publisher)2 vulnerabilities, Business apps and data
  • Fusion Middleware2 vulnerabilities, Web servers
  • Solaris2 vulnerabilities, Operating systems
  • ADF Faces1 vulnerability, Frameworks
  • Coherence1 vulnerability, Web servers
  • PeopleSoft1 vulnerability, Business apps and data
  • VirtualBox1 vulnerability, Virtualization and VDI

Name used by CISA: Oracle. Product families: indicative classification by this site.

Pace of additions

Number of Oracle vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on October 3, 2026). Source: CISA KEV catalog.
Catalog additions per 30-day period
PeriodVulnerabilities added
Sep 9, 2025 to Oct 8, 20251
Oct 9, 2025 to Nov 7, 20251
Nov 8, 2025 to Dec 7, 20251
Dec 8, 2025 to Jan 6, 20260
Jan 7, 2026 to Feb 5, 20260
Feb 6, 2026 to Mar 7, 20260
Mar 8, 2026 to Apr 6, 20260
Apr 7, 2026 to May 6, 20260
May 7, 2026 to Jun 5, 20261
Jun 6, 2026 to Jul 5, 20261
Jul 6, 2026 to Aug 4, 20261
Aug 5, 2026 to Sep 3, 20261
Sep 4, 2026 to Oct 3, 2026 (in progress)0

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Oracle list.

  1. Rank 1

    Oracle WebLogic ServerCVE-2026-21962

    Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

    Hunt for compromise (CISA)

    CVSS severity 10.0critical

    Added Aug 24, 2026

  2. Rank 2

    Oracle E-Business SuiteCVE-2026-46817

    Oracle E-Business Suite Improper Privilege Management Vulnerability

    Hunt for compromise (CISA)

    CVSS severity 9.8critical

    Added Jul 15, 2026

  3. Rank 3

    Oracle PeopleSoftCVE-2026-35273

    Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jun 12, 2026

  4. Rank 4

    Oracle Identity and Access Management (OIM / OAM)CVE-2025-61757

    Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

    CVSS severity 9.8critical

    Added Nov 21, 2025

  5. Rank 5

    Oracle E-Business SuiteCVE-2025-61882

    Oracle E-Business Suite Unspecified Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Oct 6, 2025

  6. Rank 6

    Oracle WebLogic ServerCVE-2024-21182

    Oracle WebLogic Server Unspecified Vulnerability

    CVE from 2024, added in 2026

    CVSS severity 7.5high

    Added Jun 1, 2026

  7. Rank 7

    Oracle E-Business SuiteCVE-2025-61884

    Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

    Ransomware

    CVSS severity 7.5high

    Added Oct 20, 2025

  8. Rank 8

    Oracle SolarisCVE-2020-14871

    Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

    CVSS severity 10.0critical

    Added Nov 3, 2021

  9. Rank 9

    Oracle WebLogic ServerCVE-2020-2883

    Oracle WebLogic Server Unspecified Vulnerability

    CVE from 2020, added in 2025

    CVSS severity 9.8critical

    Added Jan 7, 2025

  10. Rank 10

    Oracle WebLogic ServerCVE-2020-14644

    Oracle WebLogic Server Remote Code Execution Vulnerability

    CVE from 2020, added in 2024

    CVSS severity 9.8critical

    Added Sep 18, 2024

Show 36 more vulnerabilities
  1. Rank 11

    Oracle ADF FacesCVE-2022-21445

    Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

    CVE from 2022, added in 2024

    CVSS severity 9.8critical

    Added Sep 18, 2024

  2. Rank 12

    Oracle WebLogic ServerCVE-2020-2551

    Oracle Fusion Middleware Unspecified Vulnerability

    CVE from 2020, added in 2023

    CVSS severity 9.8critical

    Added Nov 16, 2023

  3. Rank 13

    Oracle Java SE (JRE / JDK)CVE-2016-3427

    Oracle Java SE and JRockit Unspecified Vulnerability

    CVE from 2016, added in 2023

    CVSS severity 9.8critical

    Added May 12, 2023

  4. Rank 14

    Oracle E-Business SuiteCVE-2022-21587

    Oracle E-Business Suite Unspecified Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Feb 2, 2023

  5. Rank 15

    Oracle Identity and Access Management (OIM / OAM)CVE-2021-35587

    Oracle Fusion Middleware Unspecified Vulnerability

    CVSS severity 9.8critical

    Added Nov 28, 2022

  6. Rank 16

    Oracle WebLogic ServerCVE-2018-2628

    Oracle WebLogic Server Unspecified Vulnerability

    CVE from 2018, added in 2022

    CVSS severity 9.8critical

    Added Sep 8, 2022

  7. Rank 17

    Oracle Java SE (JRE / JDK)CVE-2010-0840

    Oracle JRE Unspecified Vulnerability

    CVE from 2010, added in 2022

    CVSS severity 9.8critical

    Added May 25, 2022

  8. Rank 18

    Oracle Fusion MiddlewareCVE-2012-1710

    Oracle Fusion Middleware Unspecified Vulnerability

    RansomwareCVE from 2012, added in 2022

    CVSS severity 9.8critical

    Added May 25, 2022

  9. Rank 19

    Oracle Java SE (JRE / JDK)CVE-2013-0422

    Oracle JRE Remote Code Execution Vulnerability

    RansomwareCVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added May 25, 2022

  10. Rank 20

    Oracle Java SE (JRE / JDK)CVE-2012-5076

    Oracle Java SE Sandbox Bypass Vulnerability

    CVE from 2012, added in 2022

    CVSS severity 9.8critical

    Added Mar 28, 2022

  11. Rank 21

    Oracle Java SE (JRE / JDK)CVE-2013-2465

    Oracle Java SE Unspecified Vulnerability

    RansomwareCVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 28, 2022

  12. Rank 22

    Oracle Java SE (JRE / JDK)CVE-2011-3544

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    CVE from 2011, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  13. Rank 23

    Oracle Java SE (JRE / JDK)CVE-2012-0507

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    RansomwareCVE from 2012, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  14. Rank 24

    Oracle Java SE (JRE / JDK)CVE-2012-1723

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    RansomwareCVE from 2012, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  15. Rank 25

    Oracle Java SE (JRE / JDK)CVE-2012-4681

    Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

    RansomwareCVE from 2012, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  16. Rank 26

    Oracle Java SE (JRE / JDK)CVE-2015-2590

    Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  17. Rank 27

    Oracle WebLogic ServerCVE-2019-2725

    Oracle WebLogic Server, Injection

    RansomwareCVE from 2019, added in 2022

    CVSS severity 9.8critical

    Added Jan 10, 2022

  18. Rank 28

    Oracle WebLogic ServerCVE-2015-4852

    Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

    CVE from 2015, added in 2021

    CVSS severity 9.8critical

    Added Nov 3, 2021

  19. Rank 29

    Oracle WebLogic ServerCVE-2020-14750

    Oracle WebLogic Server Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Nov 3, 2021

  20. Rank 30

    Oracle WebLogic ServerCVE-2020-14882

    Oracle WebLogic Server Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Nov 3, 2021

  21. Rank 31

    Oracle CoherenceCVE-2020-2555

    Oracle Multiple Products Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Nov 3, 2021

  22. Rank 32

    Oracle Fusion MiddlewareCVE-2012-3152

    Oracle Fusion Middleware Unspecified Vulnerability

    CVE from 2012, added in 2021

    CVSS severity 9.1critical

    Added Nov 3, 2021

  23. Rank 33

    Oracle Agile PLMCVE-2024-20953

    Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

    CVSS severity 8.8high

    Added Feb 24, 2025

  24. Rank 34

    Oracle SolarisCVE-2019-3010

    Oracle Solaris Privilege Escalation Vulnerability

    CVE from 2019, added in 2022

    CVSS severity 8.8high

    Added May 25, 2022

  25. Rank 35

    Oracle VirtualBoxCVE-2008-3431

    Oracle VirtualBox Insufficient Input Validation Vulnerability

    CVE from 2008, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  26. Rank 36

    Oracle Agile PLMCVE-2024-21287

    Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

    CVSS severity 7.5high

    Added Nov 21, 2024

  27. Rank 37

    Oracle WebLogic ServerCVE-2023-21839

    Oracle WebLogic Server Unspecified Vulnerability

    CVSS severity 7.5high

    Added May 1, 2023

  28. Rank 38

    Oracle WebLogic ServerCVE-2017-10271

    Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

    RansomwareCVE from 2017, added in 2022

    CVSS severity 7.5high

    Added Feb 10, 2022

  29. Rank 39

    Oracle Business Intelligence (OBIEE / BI Publisher)CVE-2020-14864

    Oracle Business Intelligence Enterprise Edition Path Transversal

    CVE from 2020, added in 2022

    CVSS severity 7.5high

    Added Jan 18, 2022

  30. Rank 40

    Oracle WebLogic ServerCVE-2017-3506

    Oracle WebLogic Server OS Command Injection Vulnerability

    CVE from 2017, added in 2024

    CVSS severity 7.4high

    Added Jun 3, 2024

  31. Rank 41

    Oracle Business Intelligence (OBIEE / BI Publisher)CVE-2019-2616

    Oracle BI Publisher Unauthorized Access Vulnerability

    CVE from 2019, added in 2022

    CVSS severity 7.2high

    Added Mar 25, 2022

  32. Rank 42

    Oracle WebLogic ServerCVE-2020-14883

    Oracle WebLogic Server Unspecified Vulnerability

    CVSS severity 7.2high

    Added Nov 3, 2021

  33. Rank 43

    Oracle Java SE (JRE / JDK)CVE-2015-4902

    Oracle Java SE Integrity Check Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 5.3medium

    Added Mar 3, 2022

  34. Rank 44

    Oracle Identity and Access Management (OIM / OAM)CVE-2012-0518

    Oracle Fusion Middleware Unspecified Vulnerability

    CVE from 2012, added in 2022

    CVSS severity 4.7medium

    Added Mar 28, 2022

  35. Rank 45

    Oracle Java SE (JRE / JDK)CVE-2013-0431

    Oracle JRE Sandbox Bypass Vulnerability

    RansomwareCVE from 2013, added in 2022

    CVSS severity 3.7low

    Added May 25, 2022

  36. Rank 46

    Oracle Java SE (JRE / JDK)CVE-2013-2423

    Oracle JRE Unspecified Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 3.7low

    Added May 25, 2022

Follow and verify

Get new Oracle vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.