Oracle vulnerabilities in CISA KEV
Oracle has 46 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 6th highest of any vendor. 5 were added in the last 12 months; 13 are linked to known ransomware use (28.3% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is WebLogic Server, with 12 entries. Other frequently affected products: Java SE (7); Fusion Middleware (6).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor oracle --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
46
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-08-24
most recent entry
┌─ last 12 months
5
entries added
┌─ ransomware use
13 of 46
28.3% linked to ransomware
┌─ distinct products
17
affected products
$ awk -F, {print $1} /var/log/kev/oracle.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 7 | 0 |
| 2022 | 22 | 9 |
| 2023 | 4 | 1 |
| 2024 | 4 | 0 |
| 2025 | 5 | 2 |
| 2026 | 4 | 1 |
$ sort /var/log/kev/oracle.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- WebLogic Server 12 entries
- Java SE 7 entries
- Fusion Middleware 6 entries
- E-Business Suite 4 entries
- Java Runtime Environment (JRE) 4 entries
$ kev-due-dates --vendor oracle
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Oracle
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/oracle.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (20 of 46 have at least one CWE).
$ grep -ril 'Oracle' /var/log/news | head -5
Our reporting that names Oracle or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./oracle.kev · 46 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-21962
HTTP Server and Oracle Weblogic Server Proxy Plug-in
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
due 2026-08-27 · CWE-284
$ cat CVE-2026-21962.txt
Description. Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-46817
E-Business Suite
Oracle E-Business Suite Improper Privilege Management Vulnerability
due 2026-07-18 · CWE-269 CWE-287 CWE-306
$ cat CVE-2026-46817.txt
Description. Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-35273
PeopleSoft Enterprise PeopleTools [RANSOMWARE]
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
due 2026-06-15 · CWE-306
$ cat CVE-2026-35273.txt
Description. Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2024-21182
WebLogic Server
Oracle WebLogic Server Unspecified Vulnerability
due 2026-06-04
$ cat CVE-2024-21182.txt
Description. Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-61757
Fusion Middleware
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
due 2025-12-12 · CWE-306
$ cat CVE-2025-61757.txt
Description. Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-61884
E-Business Suite [RANSOMWARE]
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
due 2025-11-10 · CWE-918
$ cat CVE-2025-61884.txt
Description. Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-61882
E-Business Suite [RANSOMWARE]
Oracle E-Business Suite Unspecified Vulnerability
due 2025-10-27
$ cat CVE-2025-61882.txt
Description. Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-20953
Agile Product Lifecycle Management (PLM)
Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
due 2025-03-17 · CWE-502
$ cat CVE-2024-20953.txt
Description. Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-2883
WebLogic Server
Oracle WebLogic Server Unspecified Vulnerability
due 2025-01-28
$ cat CVE-2020-2883.txt
Description. Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-21287
Agile Product Lifecycle Management (PLM)
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
due 2024-12-12 · CWE-863
$ cat CVE-2024-21287.txt
Description. Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-14644
WebLogic Server
Oracle WebLogic Server Remote Code Execution Vulnerability
due 2024-10-09
$ cat CVE-2020-14644.txt
Description. Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-21445
ADF Faces
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
due 2024-10-09 · CWE-502
$ cat CVE-2022-21445.txt
Description. Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2017-3506
WebLogic Server
Oracle WebLogic Server OS Command Injection Vulnerability
due 2024-06-24 · CWE-78
$ cat CVE-2017-3506.txt
Description. Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-2551
Fusion Middleware
Oracle Fusion Middleware Unspecified Vulnerability
due 2023-12-07
$ cat CVE-2020-2551.txt
Description. Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2016-3427
Java SE and JRockit
Oracle Java SE and JRockit Unspecified Vulnerability
due 2023-06-02
$ cat CVE-2016-3427.txt
Description. Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
Required action. Apply updates per vendor instructions.
- CVE-2023-21839
WebLogic Server
Oracle WebLogic Server Unspecified Vulnerability
due 2023-05-22
$ cat CVE-2023-21839.txt
Description. Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
Required action. Apply updates per vendor instructions.
- CVE-2022-21587
E-Business Suite [RANSOMWARE]
Oracle E-Business Suite Unspecified Vulnerability
due 2023-02-23 · CWE-306
$ cat CVE-2022-21587.txt
Description. Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Required action. Apply updates per vendor instructions.
- CVE-2021-35587
Fusion Middleware
Oracle Fusion Middleware Unspecified Vulnerability
due 2022-12-19 · CWE-502 CWE-790
$ cat CVE-2021-35587.txt
Description. Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
Required action. Apply updates per vendor instructions.
- CVE-2018-2628
WebLogic Server
Oracle WebLogic Server Unspecified Vulnerability
due 2022-09-29 · CWE-502
$ cat CVE-2018-2628.txt
Description. Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
Required action. Apply updates per vendor instructions.
- CVE-2010-0840
Java Runtime Environment (JRE)
Oracle JRE Unspecified Vulnerability
due 2022-06-15
$ cat CVE-2010-0840.txt
Description. Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Required action. Apply updates per vendor instructions.
- CVE-2012-1710
Fusion Middleware [RANSOMWARE]
Oracle Fusion Middleware Unspecified Vulnerability
due 2022-06-15
$ cat CVE-2012-1710.txt
Description. Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
Required action. Apply updates per vendor instructions.
- CVE-2013-0422
Java Runtime Environment (JRE) [RANSOMWARE]
Oracle JRE Remote Code Execution Vulnerability
due 2022-06-15 · CWE-264
$ cat CVE-2013-0422.txt
Description. A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
Required action. Apply updates per vendor instructions.
- CVE-2013-0431
Java Runtime Environment (JRE) [RANSOMWARE]
Oracle JRE Sandbox Bypass Vulnerability
due 2022-06-15
$ cat CVE-2013-0431.txt
Description. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
Required action. Apply updates per vendor instructions.
- CVE-2013-2423
Java Runtime Environment (JRE)
Oracle JRE Unspecified Vulnerability
due 2022-06-15
$ cat CVE-2013-2423.txt
Description. Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
Required action. Apply updates per vendor instructions.
- CVE-2019-3010
Solaris
Oracle Solaris Privilege Escalation Vulnerability
due 2022-06-15
$ cat CVE-2019-3010.txt
Description. Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2012-0518
Fusion Middleware
Oracle Fusion Middleware Unspecified Vulnerability
due 2022-04-18 · CWE-601
$ cat CVE-2012-0518.txt
Description. Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors
Required action. Apply updates per vendor instructions.
- CVE-2012-5076
Java SE
Oracle Java SE Sandbox Bypass Vulnerability
due 2022-04-18
$ cat CVE-2012-5076.txt
Description. The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
Required action. Apply updates per vendor instructions.
- CVE-2013-2465
Java SE [RANSOMWARE]
Oracle Java SE Unspecified Vulnerability
due 2022-04-18
$ cat CVE-2013-2465.txt
Description. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
Required action. Apply updates per vendor instructions.
- CVE-2019-2616
BI Publisher (Formerly XML Publisher)
Oracle BI Publisher Unauthorized Access Vulnerability
due 2022-04-15
$ cat CVE-2019-2616.txt
Description. Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.
Required action. Apply updates per vendor instructions.
- CVE-2008-3431
VirtualBox
Oracle VirtualBox Insufficient Input Validation Vulnerability
due 2022-03-24 · CWE-264
$ cat CVE-2008-3431.txt
Description. An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2011-3544
Java SE JDK and JRE
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2011-3544.txt
Description. An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2012-0507
Java SE [RANSOMWARE]
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2012-0507.txt
Description. An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Required action. Apply updates per vendor instructions.
- CVE-2012-1723
Java SE [RANSOMWARE]
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2012-1723.txt
Description. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
Required action. Apply updates per vendor instructions.
- CVE-2012-4681
Java SE [RANSOMWARE]
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2012-4681.txt
Description. The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2015-2590
Java SE
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
due 2022-03-24
$ cat CVE-2015-2590.txt
Description. An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2015-4902
Java SE
Oracle Java SE Integrity Check Vulnerability
due 2022-03-24
$ cat CVE-2015-4902.txt
Description. Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.
Required action. Apply updates per vendor instructions.
- CVE-2017-10271
WebLogic Server [RANSOMWARE]
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
due 2022-08-10
$ cat CVE-2017-10271.txt
Description. Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-14864
Intelligence Enterprise Edition
Oracle Business Intelligence Enterprise Edition Path Transversal
due 2022-07-18 · CWE-22
$ cat CVE-2020-14864.txt
Description. Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Required action. Apply updates per vendor instructions.
- CVE-2019-2725
WebLogic Server [RANSOMWARE]
Oracle WebLogic Server, Injection
due 2022-07-10 · CWE-74
$ cat CVE-2019-2725.txt
Description. Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Required action. Apply updates per vendor instructions.
- CVE-2012-3152
Fusion Middleware
Oracle Fusion Middleware Unspecified Vulnerability
due 2022-05-03
$ cat CVE-2012-3152.txt
Description. Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.
Required action. Apply updates per vendor instructions.
- CVE-2015-4852
WebLogic Server
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2015-4852.txt
Description. Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-14750
WebLogic Server
Oracle WebLogic Server Remote Code Execution Vulnerability
due 2022-05-03
$ cat CVE-2020-14750.txt
Description. Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
Required action. Apply updates per vendor instructions.
- CVE-2020-14871
Solaris and Zettabyte File System (ZFS)
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2020-14871.txt
Description. Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
Required action. Apply updates per vendor instructions.
- CVE-2020-14882
WebLogic Server
Oracle WebLogic Server Remote Code Execution Vulnerability
due 2022-05-03
$ cat CVE-2020-14882.txt
Description. Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
Required action. Apply updates per vendor instructions.
- CVE-2020-14883
WebLogic Server
Oracle WebLogic Server Unspecified Vulnerability
due 2022-05-03
$ cat CVE-2020-14883.txt
Description. Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Required action. Apply updates per vendor instructions.
- CVE-2020-2555
Multiple Products
Oracle Multiple Products Remote Code Execution Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2020-2555.txt
Description. Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
Required action. Apply updates per vendor instructions.