How we count
Every figure on this page is a direct count of entries in CISA’s Known Exploited Vulnerabilities catalog attributed by CISA to Oracle (KEV field vendorProject), refreshed daily. “Ransomware-linked” counts entries CISA marks as known to be used in ransomware campaigns; the remainder are “unknown” to CISA, not confirmed ransomware-free. A KEV listing means the vulnerability has been observed exploited in the wild. Snapshot as of 2026-08-31.
Exploited Oracle vulnerabilities (CISA KEV)
| CVE | Product | Vulnerability | Added | |
|---|---|---|---|---|
| CVE-2026-21962 | HTTP Server and Oracle Weblogic Server Proxy Plug-in | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | 2026-08-24 | |
| CVE-2026-46817 | E-Business Suite | Oracle E-Business Suite Improper Privilege Management Vulnerability | 2026-07-15 | |
| CVE-2026-35273 | PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | 2026-06-12 | ransomware |
| CVE-2024-21182 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2026-06-01 | |
| CVE-2025-61757 | Fusion Middleware | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | 2025-11-21 | |
| CVE-2025-61884 | E-Business Suite | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | 2025-10-20 | ransomware |
| CVE-2025-61882 | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 2025-10-06 | ransomware |
| CVE-2024-20953 | Agile Product Lifecycle Management (PLM) | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | 2025-02-24 | |
| CVE-2020-2883 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2025-01-07 | |
| CVE-2024-21287 | Agile Product Lifecycle Management (PLM) | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | 2024-11-21 | |
| CVE-2020-14644 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2024-09-18 | |
| CVE-2022-21445 | ADF Faces | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 2024-09-18 | |
| CVE-2017-3506 | WebLogic Server | Oracle WebLogic Server OS Command Injection Vulnerability | 2024-06-03 | |
| CVE-2020-2551 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2023-11-16 | |
| CVE-2016-3427 | Java SE and JRockit | Oracle Java SE and JRockit Unspecified Vulnerability | 2023-05-12 | |
| CVE-2023-21839 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2023-05-01 | |
| CVE-2022-21587 | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 2023-02-02 | ransomware |
| CVE-2021-35587 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-11-28 | |
| CVE-2018-2628 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2022-09-08 | |
| CVE-2019-3010 | Solaris | Oracle Solaris Privilege Escalation Vulnerability | 2022-05-25 | |
| CVE-2013-2423 | Java Runtime Environment (JRE) | Oracle JRE Unspecified Vulnerability | 2022-05-25 | |
| CVE-2013-0431 | Java Runtime Environment (JRE) | Oracle JRE Sandbox Bypass Vulnerability | 2022-05-25 | ransomware |
| CVE-2013-0422 | Java Runtime Environment (JRE) | Oracle JRE Remote Code Execution Vulnerability | 2022-05-25 | ransomware |
| CVE-2012-1710 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-05-25 | ransomware |
| CVE-2010-0840 | Java Runtime Environment (JRE) | Oracle JRE Unspecified Vulnerability | 2022-05-25 | |
| CVE-2013-2465 | Java SE | Oracle Java SE Unspecified Vulnerability | 2022-03-28 | ransomware |
| CVE-2012-5076 | Java SE | Oracle Java SE Sandbox Bypass Vulnerability | 2022-03-28 | |
| CVE-2012-0518 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2022-03-28 | |
| CVE-2019-2616 | BI Publisher (Formerly XML Publisher) | Oracle BI Publisher Unauthorized Access Vulnerability | 2022-03-25 | |
| CVE-2015-4902 | Java SE | Oracle Java SE Integrity Check Vulnerability | 2022-03-03 | |
| CVE-2015-2590 | Java SE | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | 2022-03-03 | |
| CVE-2012-4681 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | ransomware |
| CVE-2012-1723 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | ransomware |
| CVE-2012-0507 | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | ransomware |
| CVE-2011-3544 | Java SE JDK and JRE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | 2022-03-03 | |
| CVE-2008-3431 | VirtualBox | Oracle VirtualBox Insufficient Input Validation Vulnerability | 2022-03-03 | |
| CVE-2017-10271 | WebLogic Server | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | 2022-02-10 | ransomware |
| CVE-2020-14864 | Intelligence Enterprise Edition | Oracle Business Intelligence Enterprise Edition Path Transversal | 2022-01-18 | |
| CVE-2019-2725 | WebLogic Server | Oracle WebLogic Server, Injection | 2022-01-10 | ransomware |
| CVE-2020-2555 | Multiple Products | Oracle Multiple Products Remote Code Execution Vulnerability | 2021-11-03 | |
| CVE-2012-3152 | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 2021-11-03 | |
| CVE-2020-14871 | Solaris and Zettabyte File System (ZFS) | Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability | 2021-11-03 | |
| CVE-2015-4852 | WebLogic Server | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | 2021-11-03 | |
| CVE-2020-14750 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2021-11-03 | |
| CVE-2020-14882 | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 2021-11-03 | |
| CVE-2020-14883 | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | 2021-11-03 |
← All vendors by exploited-vulnerability count
🤖 Generated by defend.network from the CISA KEV catalog. Counts are deterministic aggregates of official CISA data; verify individual advisories at the linked sources.