Oracle flaws being used in attacks

CISA lists 46 flaws in Oracle products as being used in attacks, most recently on 24 Aug 2026. 13 have been used in ransomware.

What to do

1. Update every Oracle product you use.Install the updates Oracle offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 24 Aug 2026
   Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
   CVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
   Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 15 Jul 2026
   Oracle E-Business Suite
   CVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability
   Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   CVE recordNVD
3. Being used in attacksUsed in ransomwareAdded by CISA on 12 Jun 2026
   Oracle PeopleSoft Enterprise PeopleTools
   CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
   Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 1 Jun 2026
   Oracle WebLogic Server
   CVE-2024-21182Oracle WebLogic Server Unspecified Vulnerability
   Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 21 Nov 2025
   Oracle Fusion Middleware
   CVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
   Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
6. Being used in attacksUsed in ransomwareAdded by CISA on 20 Oct 2025
   Oracle E-Business Suite
   CVE-2025-61884Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
   Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
7. Being used in attacksUsed in ransomwareAdded by CISA on 6 Oct 2025
   Oracle E-Business Suite
   CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
   Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 24 Feb 2025
   Oracle Agile Product Lifecycle Management (PLM)
   CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
   Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
9. Being used in attacksAdded by CISA on 7 Jan 2025
   Oracle WebLogic Server
   CVE-2020-2883Oracle WebLogic Server Unspecified Vulnerability
   Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
10. Being used in attacksAdded by CISA on 21 Nov 2024
    Oracle Agile Product Lifecycle Management (PLM)
    CVE-2024-21287Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
    Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
11. Being used in attacksAdded by CISA on 18 Sep 2024
    Oracle ADF Faces
    CVE-2022-21445Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
    Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
12. Being used in attacksAdded by CISA on 18 Sep 2024
    Oracle WebLogic Server
    CVE-2020-14644Oracle WebLogic Server Remote Code Execution Vulnerability
    Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
13. Being used in attacksAdded by CISA on 3 Jun 2024
    Oracle WebLogic Server
    CVE-2017-3506Oracle WebLogic Server OS Command Injection Vulnerability
    Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
14. Being used in attacksAdded by CISA on 16 Nov 2023
    Oracle Fusion Middleware
    CVE-2020-2551Oracle Fusion Middleware Unspecified Vulnerability
    Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
15. Being used in attacksAdded by CISA on 12 May 2023
    Oracle Java SE and JRockit
    CVE-2016-3427Oracle Java SE and JRockit Unspecified Vulnerability
    Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
16. Being used in attacksAdded by CISA on 1 May 2023
    Oracle WebLogic Server
    CVE-2023-21839Oracle WebLogic Server Unspecified Vulnerability
    Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
17. Being used in attacksUsed in ransomwareAdded by CISA on 2 Feb 2023
    Oracle E-Business Suite
    CVE-2022-21587Oracle E-Business Suite Unspecified Vulnerability
    Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
18. Being used in attacksAdded by CISA on 28 Nov 2022
    Oracle Fusion Middleware
    CVE-2021-35587Oracle Fusion Middleware Unspecified Vulnerability
    Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
19. Being used in attacksAdded by CISA on 8 Sep 2022
    Oracle WebLogic Server
    CVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability
    Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
20. Being used in attacksAdded by CISA on 25 May 2022
    Oracle Solaris
    CVE-2019-3010Oracle Solaris Privilege Escalation Vulnerability
    Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
21. Being used in attacksAdded by CISA on 25 May 2022
    Oracle Java Runtime Environment (JRE)
    CVE-2013-2423Oracle JRE Unspecified Vulnerability
    Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
22. Being used in attacksUsed in ransomwareAdded by CISA on 25 May 2022
    Oracle Java Runtime Environment (JRE)
    CVE-2013-0431Oracle JRE Sandbox Bypass Vulnerability
    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
23. Being used in attacksUsed in ransomwareAdded by CISA on 25 May 2022
    Oracle Java Runtime Environment (JRE)
    CVE-2013-0422Oracle JRE Remote Code Execution Vulnerability
    A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
24. Being used in attacksUsed in ransomwareAdded by CISA on 25 May 2022
    Oracle Fusion Middleware
    CVE-2012-1710Oracle Fusion Middleware Unspecified Vulnerability
    Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
25. Being used in attacksAdded by CISA on 25 May 2022
    Oracle Java Runtime Environment (JRE)
    CVE-2010-0840Oracle JRE Unspecified Vulnerability
    Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
26. Being used in attacksUsed in ransomwareAdded by CISA on 28 Mar 2022
    Oracle Java SE
    CVE-2013-2465Oracle Java SE Unspecified Vulnerability
    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
27. Being used in attacksAdded by CISA on 28 Mar 2022
    Oracle Java SE
    CVE-2012-5076Oracle Java SE Sandbox Bypass Vulnerability
    The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
28. Being used in attacksAdded by CISA on 28 Mar 2022
    Oracle Fusion Middleware
    CVE-2012-0518Oracle Fusion Middleware Unspecified Vulnerability
    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
29. Being used in attacksAdded by CISA on 25 Mar 2022
    Oracle BI Publisher (Formerly XML Publisher)
    CVE-2019-2616Oracle BI Publisher Unauthorized Access Vulnerability
    Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
30. Being used in attacksAdded by CISA on 3 Mar 2022
    Oracle Java SE
    CVE-2015-4902Oracle Java SE Integrity Check Vulnerability
    Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
31. Being used in attacksAdded by CISA on 3 Mar 2022
    Oracle Java SE
    CVE-2015-2590Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
    An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
32. Being used in attacksUsed in ransomwareAdded by CISA on 3 Mar 2022
    Oracle Java SE
    CVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
    The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
33. Being used in attacksUsed in ransomwareAdded by CISA on 3 Mar 2022
    Oracle Java SE
    CVE-2012-1723Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
34. Being used in attacksUsed in ransomwareAdded by CISA on 3 Mar 2022
    Oracle Java SE
    CVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
    An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
35. Being used in attacksAdded by CISA on 3 Mar 2022
    Oracle Java SE JDK and JRE
    CVE-2011-3544Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
    An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
36. Being used in attacksAdded by CISA on 3 Mar 2022
    Oracle VirtualBox
    CVE-2008-3431Oracle VirtualBox Insufficient Input Validation Vulnerability
    An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
37. Being used in attacksUsed in ransomwareAdded by CISA on 10 Feb 2022
    Oracle WebLogic Server
    CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
    Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
38. Being used in attacksAdded by CISA on 18 Jan 2022
    Oracle Intelligence Enterprise Edition
    CVE-2020-14864Oracle Business Intelligence Enterprise Edition Path Transversal
    Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
39. Being used in attacksUsed in ransomwareAdded by CISA on 10 Jan 2022
    Oracle WebLogic Server
    CVE-2019-2725Oracle WebLogic Server, Injection
    Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
40. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle WebLogic Server
    CVE-2020-14883Oracle WebLogic Server Unspecified Vulnerability
    Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
41. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle WebLogic Server
    CVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability
    Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
42. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle Solaris and Zettabyte File System (ZFS)
    CVE-2020-14871Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
    Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
43. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle WebLogic Server
    CVE-2020-14750Oracle WebLogic Server Remote Code Execution Vulnerability
    Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
44. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle Multiple Products
    CVE-2020-2555Oracle Multiple Products Remote Code Execution Vulnerability
    Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
45. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle WebLogic Server
    CVE-2015-4852Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
    Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
46. Being used in attacksAdded by CISA on 3 Nov 2021
    Oracle Fusion Middleware
    CVE-2012-3152Oracle Fusion Middleware Unspecified Vulnerability
    Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Oracle on CISA’s site.