Vendor

Oracle vulnerabilities under active attack

46 Oracle vulnerabilities have confirmed evidence of exploitation in the wild, and 13 are used in ransomware campaigns.

46 confirmed exploited

13 used in ransomware

46 past fix deadline

CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in Confirmed exploited CVSS 10 EPSS 42% 24 Aug 2026
CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle · E-Business Suite Confirmed exploited CVSS 9.8 EPSS 13% 15 Jul 2026
CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle · PeopleSoft Enterprise PeopleTools Used in ransomware CVSS 9.8 EPSS 95% 12 Jun 2026
CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 7.5 EPSS 74% 01 Jun 2026
CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Oracle · Fusion Middleware Weaponised CVSS 9.8 EPSS 88% 21 Nov 2025
CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Oracle · E-Business Suite Used in ransomware CVSS 7.5 EPSS 96% 20 Oct 2025
CVE-2025-61882 Oracle E-Business Suite Unspecified Vulnerability Oracle · E-Business Suite Used in ransomware CVSS 9.8 EPSS 100% 06 Oct 2025
CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability Oracle · Agile Product Lifecycle Management (PLM) Confirmed exploited CVSS 8.8 EPSS 4% 24 Feb 2025
CVE-2020-2883 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 95% 07 Jan 2025
CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability Oracle · Agile Product Lifecycle Management (PLM) Confirmed exploited CVSS 7.5 EPSS 2% 21 Nov 2024
CVE-2020-14644 Oracle WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 95% 18 Sept 2024
CVE-2022-21445 Oracle ADF Faces Deserialization of Untrusted Data Vulnerability Oracle · ADF Faces Weaponised CVSS 9.8 EPSS 62% 18 Sept 2024
CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability Oracle · WebLogic Server Weaponised CVSS 7.4 EPSS 96% 03 Jun 2024
CVE-2020-2551 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Weaponised CVSS 9.8 EPSS 93% 16 Nov 2023
CVE-2016-3427 Oracle Java SE and JRockit Unspecified Vulnerability Oracle · Java SE and JRockit Weaponised CVSS 9.8 EPSS 92% 12 May 2023
CVE-2023-21839 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 7.5 EPSS 100% 01 May 2023
CVE-2022-21587 Oracle E-Business Suite Unspecified Vulnerability Oracle · E-Business Suite Used in ransomware CVSS 9.8 EPSS 98% 02 Feb 2023
CVE-2021-35587 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Weaponised CVSS 9.8 EPSS 96% 28 Nov 2022
CVE-2018-2628 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 99% 08 Sept 2022
CVE-2019-3010 Oracle Solaris Privilege Escalation Vulnerability Oracle · Solaris Confirmed exploited CVSS 8.8 EPSS 13% 25 May 2022
CVE-2013-2423 Oracle JRE Unspecified Vulnerability Oracle · Java Runtime Environment (JRE) Weaponised CVSS 3.7 EPSS 85% 25 May 2022
CVE-2013-0431 Oracle JRE Sandbox Bypass Vulnerability Oracle · Java Runtime Environment (JRE) Used in ransomware CVSS 5.3 EPSS 90% 25 May 2022
CVE-2013-0422 Oracle JRE Remote Code Execution Vulnerability Oracle · Java Runtime Environment (JRE) Used in ransomware CVSS 9.8 EPSS 98% 25 May 2022
CVE-2012-1710 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Used in ransomware CVSS 9.8 EPSS 12% 25 May 2022
CVE-2010-0840 Oracle JRE Unspecified Vulnerability Oracle · Java Runtime Environment (JRE) Weaponised CVSS 9.8 EPSS 96% 25 May 2022
CVE-2013-2465 Oracle Java SE Unspecified Vulnerability Oracle · Java SE Used in ransomware CVSS 9.8 EPSS 99% 28 Mar 2022
CVE-2012-5076 Oracle Java SE Sandbox Bypass Vulnerability Oracle · Java SE Weaponised CVSS 9.8 EPSS 91% 28 Mar 2022
CVE-2012-0518 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Confirmed exploited CVSS 4.7 EPSS 5% 28 Mar 2022
CVE-2019-2616 Oracle BI Publisher Unauthorized Access Vulnerability Oracle · BI Publisher (Formerly XML Publisher) Weaponised CVSS 7.2 EPSS 92% 25 Mar 2022
CVE-2015-4902 Oracle Java SE Integrity Check Vulnerability Oracle · Java SE Confirmed exploited CVSS 5.3 EPSS 13% 03 Mar 2022
CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability Oracle · Java SE Confirmed exploited CVSS 9.8 EPSS 25% 03 Mar 2022
CVE-2012-4681 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Oracle · Java SE Used in ransomware CVSS 9.8 EPSS 99% 03 Mar 2022
CVE-2012-1723 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Oracle · Java SE Used in ransomware CVSS 9.8 EPSS 94% 03 Mar 2022
CVE-2012-0507 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Oracle · Java SE Used in ransomware CVSS 9.8 EPSS 98% 03 Mar 2022
CVE-2011-3544 Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Oracle · Java SE JDK and JRE Weaponised CVSS 9.8 EPSS 97% 03 Mar 2022
CVE-2008-3431 Oracle VirtualBox Insufficient Input Validation Vulnerability Oracle · VirtualBox Confirmed exploited CVSS 8.8 EPSS 7% 03 Mar 2022
CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Used in ransomware CVSS 7.5 EPSS 100% 10 Feb 2022
CVE-2020-14864 Oracle Business Intelligence Enterprise Edition Path Transversal Oracle · Intelligence Enterprise Edition Weaponised CVSS 7.5 EPSS 97% 18 Jan 2022
CVE-2019-2725 Oracle WebLogic Server, Injection Oracle · WebLogic Server Used in ransomware CVSS 9.8 EPSS 100% 10 Jan 2022
CVE-2020-2555 Oracle Multiple Products Remote Code Execution Vulnerability Oracle · Multiple Products Weaponised CVSS 9.8 EPSS 97% 03 Nov 2021
CVE-2012-3152 Oracle Fusion Middleware Unspecified Vulnerability Oracle · Fusion Middleware Weaponised CVSS 9.1 EPSS 99% 03 Nov 2021
CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability Oracle · Solaris and Zettabyte File System (ZFS) Weaponised CVSS 10 EPSS 80% 03 Nov 2021
CVE-2015-4852 Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 96% 03 Nov 2021
CVE-2020-14750 Oracle WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 99% 03 Nov 2021
CVE-2020-14882 Oracle WebLogic Server Remote Code Execution Vulnerability Oracle · WebLogic Server Weaponised CVSS 9.8 EPSS 100% 03 Nov 2021
CVE-2020-14883 Oracle WebLogic Server Unspecified Vulnerability Oracle · WebLogic Server Weaponised CVSS 7.2 EPSS 98% 03 Nov 2021