CyberMax
Home › Exploited CVEs

Oracle known exploited vulnerabilities

CISA KEV catalog 2026.09.25 (1,726 CVEs) with FIRST EPSS scores from 2026-09-27.

CISA lists 46 Oracle CVEs as exploited in the wild. 7 were added in the last 12 months (latest 2026-08-24), and 13 are known to be used in ransomware campaigns.

Oracle CVEs added to CISA KEV per year
2021: 7202172022: 222022222023: 4202342024: 4202442025: 5202552026: 420264

Year = when CISA added the CVE to the catalog (KEV started in November 2021).

Patch first: highest EPSS right now

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.

Most affected Oracle products

WebLogic Server (12), Java SE (7), Fusion Middleware (6), E-Business Suite (4), Java Runtime Environment (JRE) (4), Agile Product Lifecycle Management (PLM) (2), HTTP Server and Oracle Weblogic Server Proxy Plug-in (1), PeopleSoft Enterprise PeopleTools (1), ADF Faces (1), Java SE and JRockit (1), Solaris (1), BI Publisher (Formerly XML Publisher) (1).

All Oracle CVEs in KEV

CVEProductFlawAddedFederal dueEPSSRansomware
CVE-2026-21962HTTP Server and Oracle Weblogic Server Proxy Plug-inHTTP Server and Weblogic Server Proxy Plug-in Improper Access Control2026-08-242026-08-2770.9%–
CVE-2026-46817E-Business SuiteE-Business Suite Improper Privilege Management2026-07-152026-07-180.8%–
CVE-2026-35273 PeopleSoft Enterprise PeopleToolsPeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function2026-06-122026-06-159.4%Yes
CVE-2024-21182WebLogic ServerWebLogic Server Unspecified2026-06-012026-06-0474.2%–
CVE-2025-61757Fusion MiddlewareFusion Middleware Missing Authentication for Critical Function2025-11-212025-12-1288.6%–
CVE-2025-61884E-Business SuiteE-Business Suite Server-Side Request Forgery (SSRF)2025-10-202025-11-1095.9%Yes
CVE-2025-61882E-Business SuiteE-Business Suite Unspecified2025-10-062025-10-2799.7%Yes
CVE-2024-20953Agile Product Lifecycle Management (PLM)Agile Product Lifecycle Management (PLM) Deserialization2025-02-242025-03-173.9%–
CVE-2020-2883WebLogic ServerWebLogic Server Unspecified2025-01-072025-01-2894.9%–
CVE-2024-21287Agile Product Lifecycle Management (PLM)Agile Product Lifecycle Management (PLM) Incorrect Authorization2024-11-212024-12-121.7%–
CVE-2022-21445ADF FacesADF Faces Deserialization of Untrusted Data2024-09-182024-10-0962.5%–
CVE-2020-14644WebLogic ServerWebLogic Server Remote Code Execution2024-09-182024-10-0994.5%–
CVE-2017-3506WebLogic ServerWebLogic Server OS Command Injection2024-06-032024-06-2496.3%–
CVE-2020-2551Fusion MiddlewareFusion Middleware Unspecified2023-11-162023-12-0793.2%–
CVE-2016-3427Java SE and JRockitJava SE and JRockit Unspecified2023-05-122023-06-0292.3%–
CVE-2023-21839WebLogic ServerWebLogic Server Unspecified2023-05-012023-05-2299.9%–
CVE-2022-21587E-Business SuiteE-Business Suite Unspecified2023-02-022023-02-2398.3%Yes
CVE-2021-35587Fusion MiddlewareFusion Middleware Unspecified2022-11-282022-12-1996.3%–
CVE-2018-2628WebLogic ServerWebLogic Server Unspecified2022-09-082022-09-29100.0%–
CVE-2019-3010SolarisSolaris Privilege Escalation2022-05-252022-06-1513.4%–
CVE-2013-2423Java Runtime Environment (JRE)JRE Unspecified2022-05-252022-06-1585.2%–
CVE-2013-0431Java Runtime Environment (JRE)JRE Sandbox Bypass2022-05-252022-06-1590.2%Yes
CVE-2013-0422Java Runtime Environment (JRE)JRE Remote Code Execution2022-05-252022-06-1597.0%Yes
CVE-2012-1710Fusion MiddlewareFusion Middleware Unspecified2022-05-252022-06-157.8%Yes
CVE-2010-0840Java Runtime Environment (JRE)JRE Unspecified2022-05-252022-06-1596.3%–
CVE-2013-2465Java SEJava SE Unspecified2022-03-282022-04-1898.8%Yes
CVE-2012-5076Java SEJava SE Sandbox Bypass2022-03-282022-04-1891.2%–
CVE-2012-0518Fusion MiddlewareFusion Middleware Unspecified2022-03-282022-04-184.7%–
CVE-2019-2616BI Publisher (Formerly XML Publisher)BI Publisher Unauthorized Access2022-03-252022-04-1592.2%–
CVE-2015-4902Java SEJava SE Integrity Check2022-03-032022-03-2413.6%–
CVE-2015-2590Java SEJava SE and Java SE Embedded Remote Code Execution2022-03-032022-03-2425.5%–
CVE-2012-4681Java SEJava SE Runtime Environment (JRE) Arbitrary Code Execution2022-03-032022-03-2498.5%Yes
CVE-2012-1723Java SEJava SE Runtime Environment (JRE) Arbitrary Code Execution2022-03-032022-03-2493.7%Yes
CVE-2012-0507Java SEJava SE Runtime Environment (JRE) Arbitrary Code Execution2022-03-032022-03-2498.1%Yes
CVE-2011-3544Java SE JDK and JREJava SE Runtime Environment (JRE) Arbitrary Code Execution2022-03-032022-03-2496.7%–
CVE-2008-3431VirtualBoxVirtualBox Insufficient Input Validation2022-03-032022-03-246.9%–
CVE-2017-10271WebLogic ServerCorporation WebLogic Server Remote Code Execution2022-02-102022-08-10100.0%Yes
CVE-2020-14864Intelligence Enterprise EditionBusiness Intelligence Enterprise Edition Path Transversal2022-01-182022-07-1897.2%–
CVE-2019-2725WebLogic ServerWebLogic Server, Injection2022-01-102022-07-10100.0%Yes
CVE-2020-2555Multiple ProductsMultiple Products Remote Code Execution2021-11-032022-05-0397.1%–
CVE-2020-14883WebLogic ServerWebLogic Server Unspecified2021-11-032022-05-0397.9%–
CVE-2020-14882WebLogic ServerWebLogic Server Remote Code Execution2021-11-032022-05-03100.0%–
CVE-2020-14871Solaris and Zettabyte File System (ZFS)Solaris and Zettabyte File System (ZFS) Unspecified2021-11-032022-05-0380.2%–
CVE-2020-14750WebLogic ServerWebLogic Server Remote Code Execution2021-11-032022-05-0399.3%–
CVE-2015-4852WebLogic ServerWebLogic Server Deserialization of Untrusted Data2021-11-032022-05-0396.0%–
CVE-2012-3152Fusion MiddlewareFusion Middleware Unspecified2021-11-032022-05-0398.8%–
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.

Read next: Which CVEs to patch first this week · All vendors