Oracle Fusion Middleware known exploited vulnerabilities, ranked
CISA lists 6 Oracle Fusion Middleware CVEs as exploited in the wild. 1 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2012-3152: EPSS 98.8%, added 2021-11-03
- CVE-2021-35587: EPSS 96.3%, added 2022-11-28
- CVE-2020-2551: EPSS 93.2%, added 2023-11-16
- CVE-2025-61757: EPSS 88.6%, added 2025-11-21
- CVE-2012-1710: EPSS 7.8%, used in ransomware, added 2022-05-25
All 6 Oracle Fusion Middleware CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2012-3152 | Fusion Middleware Unspecified | 98.8% | – | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2021-35587 | Fusion Middleware Unspecified | 96.3% | – | 2022-11-28 | 2022-12-19 |
| 3 | CVE-2020-2551 | Fusion Middleware Unspecified | 93.2% | – | 2023-11-16 | 2023-12-07 |
| 4 | CVE-2025-61757 | Fusion Middleware Missing Authentication for Critical Function | 88.6% | – | 2025-11-21 | 2025-12-12 |
| 5 | CVE-2012-1710 | Fusion Middleware Unspecified | 7.8% | Yes | 2022-05-25 | 2022-06-15 |
| 6 | CVE-2012-0518 | Fusion Middleware Unspecified | 4.7% | – | 2022-03-28 | 2022-04-18 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Oracle KEV CVEs · other Oracle products: WebLogic Server · Java SE · free KEV badge for Oracle · all vendors