Oracle known exploited vulnerabilities
Every Oracle CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 46 in all, 5 added in the last 12 months.
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-61884Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).Oracle Configurator
- CVE-2025-61882Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).Oracle Concurrent Processing
- CVE-2022-21587Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).Oracle Web Applications Desktop Integrator
- CVE-2013-0431Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-
- CVE-2013-0422Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean
- CVE-2012-1710Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers t
- CVE-2013-2465Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier
- CVE-2012-4681Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to
- CVE-2012-1723Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier,
- CVE-2012-0507Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,
- CVE-2017-10271Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).Oracle WebLogic Server
- CVE-2019-2725Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).Oracle Tape Library ACSLS
FAQ
Oracle KEV questions.
How many Oracle vulnerabilities are in CISA KEV?
46 Oracle vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 5 of them added in the last 12 months. The newest is CVE-2026-21962 (Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability), added 2026-08-24.
Which Oracle products are in CISA KEV?
17 products, including HTTP Server and Oracle Weblogic Server Proxy Plug-in, E-Business Suite, PeopleSoft Enterprise PeopleTools. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Oracle KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 13 of the 46 Oracle entries.