{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:38:01.102Z",
  "tag": {
    "id": "oracle",
    "label": "Oracle",
    "isStack": false,
    "url": "https://pwn.watch/t/oracle",
    "feed": "https://pwn.watch/t/oracle/feed.xml"
  },
  "counts": {
    "incidents": 15,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 15
  },
  "incidents": [
    {
      "slug": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "title": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "json": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-21962"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-24",
      "closedAt": "2026-08-24",
      "updatedAt": "2026-08-24",
      "summary": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.",
      "xPost": null
    },
    {
      "slug": "oracle-e-business-suite-cve-2026-46817",
      "title": "Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerability",
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2026-46817",
      "json": "https://pwn.watch/i/oracle-e-business-suite-cve-2026-46817.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-46817"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-15",
      "closedAt": "2026-07-15",
      "updatedAt": "2026-07-15",
      "summary": "Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Added to CISA KEV on 2026-07-15.",
      "xPost": null
    },
    {
      "slug": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273",
      "title": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability",
      "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273",
      "json": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle  PeopleSoft Enterprise PeopleTools",
      "tags": [
        "oracle",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-35273"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-12",
      "closedAt": "2026-06-12",
      "updatedAt": "2026-06-12",
      "summary": "Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.",
      "xPost": null
    },
    {
      "slug": "oracle-fusion-middleware-cve-2025-61757",
      "title": "Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability",
      "url": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757",
      "json": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle Fusion Middleware",
      "tags": [
        "oracle",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-61757"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-11-21",
      "closedAt": "2025-11-21",
      "updatedAt": "2025-11-21",
      "summary": "Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. Added to CISA KEV on 2025-11-21.",
      "xPost": null
    },
    {
      "slug": "oracle-e-business-suite-cve-2025-61884",
      "title": "Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884",
      "json": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-61884"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-20",
      "closedAt": "2025-10-20",
      "updatedAt": "2025-10-20",
      "summary": "Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Added to CISA KEV on 2025-10-20.",
      "xPost": null
    },
    {
      "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882",
      "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "cl0p",
        "zero-day",
        "rce",
        "data-breach",
        "extortion",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-61882"
      ],
      "affectedVersions": [
        "Oracle E-Business Suite 12.2.3 to 12.2.14"
      ],
      "fixedVersions": [
        "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-10-20",
      "updatedAt": "2025-10-20",
      "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.",
      "xPost": null
    },
    {
      "slug": "oracle-cloud-classic-login-breach-march-2025",
      "title": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale",
      "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025",
      "json": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Oracle Cloud Classic (Gen 1) login/IDM servers",
      "tags": [
        "hosting",
        "oracle",
        "oracle-cloud",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-03-21",
      "closedAt": "2025-04-08",
      "updatedAt": "2025-04-08",
      "summary": "A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.",
      "xPost": null
    },
    {
      "slug": "oracle-agile-product-lifecycle-management-plm-cve-2024-20953",
      "title": "Oracle Agile Product Lifecycle Management (PLM): Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
      "url": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-20953",
      "json": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-20953.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle Agile Product Lifecycle Management (PLM)",
      "tags": [
        "oracle",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20953"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-24",
      "closedAt": "2025-02-24",
      "updatedAt": "2025-02-24",
      "summary": "Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system. Added to CISA KEV on 2025-02-24.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2020-2883",
      "title": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2020-2883"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-07",
      "closedAt": "2025-01-07",
      "updatedAt": "2025-01-07",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Added to CISA KEV on 2025-01-07.",
      "xPost": null
    },
    {
      "slug": "oracle-agile-product-lifecycle-management-plm-cve-2024-21287",
      "title": "Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization",
      "url": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287",
      "json": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle Agile Product Lifecycle Management (PLM)",
      "tags": [
        "oracle",
        "oracle-agile-plm",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-21287"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-18",
      "closedAt": "2024-11-21",
      "updatedAt": "2024-11-21",
      "summary": "Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. Added to the CISA KEV catalog on 2024-11-21.",
      "xPost": null
    },
    {
      "slug": "oracle-adf-faces-cve-2022-21445",
      "title": "Oracle ADF Faces Deserialization of Untrusted Data",
      "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445",
      "json": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle ADF Faces",
      "tags": [
        "java",
        "oracle",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2022-21445"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-18",
      "closedAt": "2024-09-18",
      "updatedAt": "2024-09-18",
      "summary": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2020-14644",
      "title": "Oracle WebLogic Server Remote Code Execution",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2020-14644"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-18",
      "closedAt": "2024-09-18",
      "updatedAt": "2024-09-18",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2017-3506",
      "title": "Oracle WebLogic Server OS Command Injection",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2017-3506"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-03",
      "closedAt": "2024-06-03",
      "updatedAt": "2024-06-03",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2023-21839",
      "title": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-21839"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-01",
      "closedAt": "2023-05-01",
      "updatedAt": "2023-05-01",
      "summary": "Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Added to CISA KEV on 2023-05-01.",
      "xPost": null
    },
    {
      "slug": "oracle-e-business-suite-cve-2022-21587",
      "title": "Oracle E-Business Suite: Unspecified (CVE-2022-21587)",
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587",
      "json": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2022-21587"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-02-02",
      "closedAt": "2023-02-02",
      "updatedAt": "2023-02-02",
      "summary": "Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Added to CISA KEV on 2023-02-02. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "incidentTitle": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-24",
      "title": "CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962"
    },
    {
      "incident": "oracle-e-business-suite-cve-2026-46817",
      "incidentTitle": "Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-15",
      "title": "CISA added CVE-2026-46817 to the KEV catalog (due 2026-07-18).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2026-46817"
    },
    {
      "incident": "oracle-peoplesoft-enterprise-peopletools-cve-2026-35273",
      "incidentTitle": "Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-12",
      "title": "CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273"
    },
    {
      "incident": "oracle-fusion-middleware-cve-2025-61757",
      "incidentTitle": "Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-21",
      "title": "CISA added CVE-2025-61757 to the KEV catalog (due 2025-12-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757"
    },
    {
      "incident": "oracle-e-business-suite-cve-2025-61884",
      "incidentTitle": "Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "CISA added CVE-2025-61884 to the KEV catalog (due 2025-11-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2025-61884"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-06",
      "title": "CISA adds CVE-2025-61882 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-04",
      "title": "Oracle publishes a Security Alert for CVE-2025-61882",
      "body": null,
      "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "Cl0p-branded extortion emails start arriving at executives",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-cloud-classic-login-breach-march-2025",
      "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-04-08",
      "title": "Reports that Oracle privately confirmed the breach to customers",
      "body": null,
      "sourceUrl": "https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082",
      "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025"
    },
    {
      "incident": "oracle-cloud-classic-login-breach-march-2025",
      "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-03-21",
      "title": "rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/",
      "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025"
    },
    {
      "incident": "oracle-agile-product-lifecycle-management-plm-cve-2024-20953",
      "incidentTitle": "Oracle Agile Product Lifecycle Management (PLM): Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-24",
      "title": "CISA added CVE-2024-20953 to the KEV catalog (due 2025-03-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-20953"
    },
    {
      "incident": "oracle-weblogic-server-cve-2020-2883",
      "incidentTitle": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-07",
      "title": "CISA added CVE-2020-2883 to the KEV catalog (due 2025-01-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883"
    },
    {
      "incident": "oracle-agile-product-lifecycle-management-plm-cve-2024-21287",
      "incidentTitle": "Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-21",
      "title": "CISA added CVE-2024-21287 to the KEV catalog (federal deadline 2024-12-12)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287"
    },
    {
      "incident": "oracle-agile-product-lifecycle-management-plm-cve-2024-21287",
      "incidentTitle": "Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CVE-2024-21287 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21287",
      "url": "https://pwn.watch/i/oracle-agile-product-lifecycle-management-plm-cve-2024-21287"
    },
    {
      "incident": "oracle-adf-faces-cve-2022-21445",
      "incidentTitle": "Oracle ADF Faces Deserialization of Untrusted Data",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-18",
      "title": "CISA added CVE-2022-21445 to the KEV catalog (federal deadline 2024-10-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-adf-faces-cve-2022-21445"
    },
    {
      "incident": "oracle-weblogic-server-cve-2020-14644",
      "incidentTitle": "Oracle WebLogic Server Remote Code Execution",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-18",
      "title": "CISA added CVE-2020-14644 to the KEV catalog (federal deadline 2024-10-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644"
    },
    {
      "incident": "oracle-weblogic-server-cve-2017-3506",
      "incidentTitle": "Oracle WebLogic Server OS Command Injection",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-03",
      "title": "CISA added CVE-2017-3506 to the KEV catalog (federal deadline 2024-06-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506"
    },
    {
      "incident": "oracle-weblogic-server-cve-2023-21839",
      "incidentTitle": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-01",
      "title": "CISA added CVE-2023-21839 to the KEV catalog (due 2023-05-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839"
    },
    {
      "incident": "oracle-e-business-suite-cve-2022-21587",
      "incidentTitle": "Oracle E-Business Suite: Unspecified (CVE-2022-21587)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-02",
      "title": "CISA added CVE-2022-21587 to the KEV catalog (due 2023-02-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-e-business-suite-cve-2022-21587"
    }
  ]
}