Oracle

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in ✓Patched

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.

Oracle E-Business Suite ✓Patched

Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Added to CISA KEV on 2026-07-15.

Oracle PeopleSoft Enterprise PeopleTools ✓Patched

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.

Oracle Fusion Middleware ✓Patched

Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. Added to CISA KEV on 2025-11-21.

Oracle E-Business Suite ✓Patched

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Added to CISA KEV on 2025-10-20.

Oracle Cloud Classic (Gen 1) login/IDM servers –No fix needed

A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Oracle Agile Product Lifecycle Management (PLM) ✓Patched

Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system. Added to CISA KEV on 2025-02-24.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Added to CISA KEV on 2025-01-07.

Oracle Agile Product Lifecycle Management (PLM) ✓Patched

Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. Added to the CISA KEV catalog on 2024-11-21.

Oracle ADF Faces ✓Patched

Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Added to CISA KEV on 2023-05-01.

Oracle E-Business Suite ✓Patched

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Added to CISA KEV on 2023-02-02. CISA lists known use in ransomware campaigns.