Oracle: exploited vulnerabilities
- 46exploited vulnerabilities
- 13used by ransomware
- Aug 24, 2026latest one added
- WebLogic Server 12
- Java SE 7
- Fusion Middleware 6
- E-Business Suite 4
- Java Runtime Environment (JRE) 4
- Agile Product Lifecycle Management (PLM) 2
- HTTP Server and Oracle Weblogic Server Proxy Plug-in 1
- PeopleSoft Enterprise PeopleTools 1
- ADF Faces 1
- Java SE and JRockit 1
- Solaris 1
- BI Publisher (Formerly XML Publisher) 1
- Java SE JDK and JRE 1
- VirtualBox 1
- Intelligence Enterprise Edition 1
- Multiple Products 1
- Solaris and Zettabyte File System (ZFS) 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 24, 2026 | Improper Access Control | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Critical 10.0 | 73% |
| Jul 15, 2026 | Improper Privilege Management | E-Business Suite | Critical 9.8 | 12% |
| Jun 12, 2026 | PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function | PeopleSoft Enterprise PeopleTools | Critical 9.8 | 97% |
| Jun 1, 2026 | Unspecified | WebLogic Server | High 7.5 | 74% |
| Nov 21, 2025 | Missing Authentication for Critical Function | Fusion Middleware | Critical 9.8 | 89% |
| Oct 20, 2025 | Server-Side Request Forgery (SSRF) | E-Business Suite | High 7.5 | 96% |
| Oct 6, 2025 | Unspecified | E-Business Suite | Critical 9.8 | 99.7% |
| Feb 24, 2025 | Deserialization | Agile Product Lifecycle Management (PLM) | High 8.8 | 3.9% |
| Jan 7, 2025 | Unspecified | WebLogic Server | Critical 9.8 | 95% |
| Nov 21, 2024 | Incorrect Authorization | Agile Product Lifecycle Management (PLM) | High 7.5 | 1.7% |
| Sep 18, 2024 | Deserialization of Untrusted Data | ADF Faces | Critical 9.8 | 62% |
| Sep 18, 2024 | Remote Code Execution | WebLogic Server | Critical 9.8 | 95% |
| Jun 3, 2024 | OS Command Injection | WebLogic Server | High 7.4 | 96% |
| Nov 16, 2023 | Unspecified | Fusion Middleware | Critical 9.8 | 93% |
| May 12, 2023 | Unspecified | Java SE and JRockit | Critical 9.8 | 92% |
| May 1, 2023 | Unspecified | WebLogic Server | High 7.5 | 99.9% |
| Feb 2, 2023 | Unspecified | E-Business Suite | Critical 9.8 | 98% |
| Nov 28, 2022 | Unspecified | Fusion Middleware | Critical 9.8 | 96% |
| Sep 8, 2022 | Unspecified | WebLogic Server | Critical 9.8 | >99.9% |
| May 25, 2022 | Privilege Escalation | Solaris | High 8.8 | 13% |
| May 25, 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Low 3.7 | 85% |
| May 25, 2022 | JRE Sandbox Bypass | Java Runtime Environment (JRE) | Low 3.7 | 90% |
| May 25, 2022 | JRE Remote Code Execution | Java Runtime Environment (JRE) | Critical 9.8 | 97% |
| May 25, 2022 | Unspecified | Fusion Middleware | Critical 9.8 | 7.8% |
| May 25, 2022 | JRE Unspecified | Java Runtime Environment (JRE) | Critical 9.8 | 96% |
| Mar 28, 2022 | Unspecified | Java SE | Critical 9.8 | 99% |
| Mar 28, 2022 | Sandbox Bypass | Java SE | Critical 9.8 | 91% |
| Mar 28, 2022 | Unspecified | Fusion Middleware | Medium 4.7 | 4.7% |
| Mar 25, 2022 | BI Publisher Unauthorized Access | BI Publisher (Formerly XML Publisher) | High 7.2 | 92% |
| Mar 3, 2022 | Integrity Check | Java SE | Medium 5.3 | 14% |
| Mar 3, 2022 | and Java SE Embedded Remote Code Execution | Java SE | Critical 9.8 | 25% |
| Mar 3, 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critical 9.8 | 99% |
| Mar 3, 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critical 9.8 | 94% |
| Mar 3, 2022 | Runtime Environment (JRE) Arbitrary Code Execution | Java SE | Critical 9.8 | 98% |
| Mar 3, 2022 | Java SE Runtime Environment (JRE) Arbitrary Code Execution | Java SE JDK and JRE | Critical 9.8 | 97% |
| Mar 3, 2022 | Insufficient Input Validation | VirtualBox | High 8.8 | 6.9% |
| Feb 10, 2022 | Corporation WebLogic Server Remote Code Execution | WebLogic Server | High 7.5 | >99.9% |
| Jan 18, 2022 | Business Intelligence Enterprise Edition Path Transversal | Intelligence Enterprise Edition | High 7.5 | 97% |
| Jan 10, 2022 | WebLogic Server, Injection | WebLogic Server | High 7.5 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Multiple Products | Critical 9.8 | 97% |
| Nov 3, 2021 | Unspecified | WebLogic Server | High 7.2 | 98% |
| Nov 3, 2021 | Remote Code Execution | WebLogic Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Unspecified | Solaris and Zettabyte File System (ZFS) | Critical 10.0 | 80% |
| Nov 3, 2021 | Remote Code Execution | WebLogic Server | Critical 9.8 | 99.2% |
| Nov 3, 2021 | Deserialization of Untrusted Data | WebLogic Server | Critical 9.8 | 95% |
| Nov 3, 2021 | Unspecified | Fusion Middleware | Critical 9.1 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.