All vendors
Oracle KEV entries added per year — 2021: 7, 2022: 22, 2023: 4, 2024: 4, 2025: 5, 2026: 4.
Oracle — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Oracle with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
46 KEV entries
13 ransomware-linked
17 products
avg CVSS 8.8
last added 2026-08-24
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 46 Oracle vulnerabilities confirmed as exploited in the wild across 17 products; 13 of them (28%) are flagged as used in known ransomware campaigns. WebLogic Server is the most-affected product, with 12 entries (26% of the total). CISA added 4 entries in 2026 so far, compared with 5 in 2025. Across the 46 entries with an NVD CVSS score (100% of the total), the average score is 8.8; 30 entries are rated critical by NVD. The most recent addition is CVE-2026-21962 (Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability), added on 2026-08-24.
Affected products
| Product | Entries | Share |
|---|---|---|
| WebLogic Server | 12 | 26% |
| Java SE | 7 | 15% |
| Fusion Middleware | 6 | 13% |
| E-Business Suite | 4 | 8.7% |
| Java Runtime Environment (JRE) | 4 | 8.7% |
| Agile Product Lifecycle Management (PLM) | 2 | 4.3% |
| HTTP Server and Oracle Weblogic Server Proxy Plug-in | 1 | 2.2% |
| PeopleSoft Enterprise PeopleTools | 1 | 2.2% |
| ADF Faces | 1 | 2.2% |
| Java SE and JRockit | 1 | 2.2% |
| Solaris | 1 | 2.2% |
| BI Publisher (Formerly XML Publisher) | 1 | 2.2% |
| Java SE JDK and JRE | 1 | 2.2% |
| VirtualBox | 1 | 2.2% |
| Intelligence Enterprise Edition | 1 | 2.2% |
| Multiple Products | 1 | 2.2% |
| Solaris and Zettabyte File System (ZFS) | 1 | 2.2% |
Entries added per year
By date added to the KEV catalog
Exploited Oracle vulnerabilities (46)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-21962 | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | 2026-08-24 | — | CRITICAL10.0 |
| CVE-2026-46817 | E-Business Suite | Oracle E-Business Suite Improper Privilege Management Vulnerability | 2026-07-15 | — | CRITICAL9.8 |
| CVE-2026-35273 | PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | 2026-06-12 | Known | CRITICAL9.8 |
| CVE-2024-21182 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2026-06-01 | — | HIGH7.5 |
| CVE-2025-61757 | Fusion Middleware | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | 2025-11-21 | — | CRITICAL9.8 |
| CVE-2025-61884 | E-Business Suite | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | 2025-10-20 | Known | HIGH7.5 |
| CVE-2025-61882 | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 2025-10-06 | Known | CRITICAL9.8 |
| CVE-2024-20953 | Agile Product Lifecycle Management (PLM) | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | 2025-02-24 | — | HIGH8.8 |
| CVE-2020-2883 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2025-01-07 | — | CRITICAL9.8 |
| CVE-2024-21287 | Agile Product Lifecycle Management (PLM) | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | 2024-11-21 | — | HIGH7.5 |
| CVE-2020-14644 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2024-09-18 | — | CRITICAL9.8 |
| CVE-2022-21445 | ADF Faces | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 2024-09-18 | — | CRITICAL9.8 |
| CVE-2017-3506 | WebLogic Server | Oracle WebLogic Server OS Command Injection Vulnerability | 2024-06-03 | — | HIGH7.4 |
| CVE-2020-2551 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2023-11-16 | — | CRITICAL9.8 |
| CVE-2016-3427 | Java SE and JRockit | Oracle Java SE and JRockit Unspecified Vulnerability | 2023-05-12 | — | CRITICAL9.8 |
| CVE-2023-21839 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2023-05-01 | — | HIGH7.5 |
| CVE-2022-21587 | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 2023-02-02 | Known | CRITICAL9.8 |
| CVE-2021-35587 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-11-28 | — | CRITICAL9.8 |
| CVE-2018-2628 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2022-09-08 | — | CRITICAL9.8 |
| CVE-2019-3010 | Solaris | Oracle Solaris Privilege Escalation Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2013-2423 | Java Runtime Environment (JRE) | Oracle JRE Unspecified Vulnerability | 2022-05-25 | — | LOW3.7 |
| CVE-2013-0431 | Java Runtime Environment (JRE) | Oracle JRE Sandbox Bypass Vulnerability | 2022-05-25 | Known | LOW3.7 |
| CVE-2013-0422 | Java Runtime Environment (JRE) | Oracle JRE Remote Code Execution Vulnerability | 2022-05-25 | Known | CRITICAL9.8 |
| CVE-2012-1710 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-05-25 | Known | CRITICAL9.8 |
| CVE-2010-0840 | Java Runtime Environment (JRE) | Oracle JRE Unspecified Vulnerability | 2022-05-25 | — | CRITICAL9.8 |
| CVE-2013-2465 | Java SE | Oracle Java SE Unspecified Vulnerability | 2022-03-28 | Known | CRITICAL9.8 |
| CVE-2012-5076 | Java SE | Oracle Java SE Sandbox Bypass Vulnerability | 2022-03-28 | — | CRITICAL9.8 |
| CVE-2012-0518 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-03-28 | — | MEDIUM4.7 |
| CVE-2019-2616 | BI Publisher (Formerly XML Publisher) | Oracle BI Publisher Unauthorized Access Vulnerability | 2022-03-25 | — | HIGH7.2 |
| CVE-2015-4902 | Java SE | Oracle Java SE Integrity Check Vulnerability | 2022-03-03 | — | MEDIUM5.3 |
| CVE-2015-2590 | Java SE | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2012-4681 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | CRITICAL9.8 |
| CVE-2012-1723 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | CRITICAL9.8 |
| CVE-2012-0507 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | CRITICAL9.8 |
| CVE-2011-3544 | Java SE JDK and JRE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2008-3431 | VirtualBox | Oracle VirtualBox Insufficient Input Validation Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2017-10271 | WebLogic Server | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | 2022-02-10 | Known | HIGH7.5 |
| CVE-2020-14864 | Intelligence Enterprise Edition | Oracle Business Intelligence Enterprise Edition Path Transversal | 2022-01-18 | — | HIGH7.5 |
| CVE-2019-2725 | WebLogic Server | Oracle WebLogic Server, Injection | 2022-01-10 | Known | CRITICAL9.8 |
| CVE-2020-2555 | Multiple Products | Oracle Multiple Products Remote Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2012-3152 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2021-11-03 | — | CRITICAL9.1 |
| CVE-2020-14871 | Solaris and Zettabyte File System (ZFS) | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | 2021-11-03 | — | CRITICAL10.0 |
| CVE-2015-4852 | WebLogic Server | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2020-14750 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2020-14882 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2020-14883 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2021-11-03 | — | HIGH7.2 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.