{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:39:04.690Z",
  "tag": {
    "id": "weblogic",
    "label": "WebLogic",
    "isStack": false,
    "url": "https://pwn.watch/t/weblogic",
    "feed": "https://pwn.watch/t/weblogic/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "title": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "json": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-21962"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-24",
      "closedAt": "2026-08-24",
      "updatedAt": "2026-08-24",
      "summary": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2020-2883",
      "title": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2020-2883"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-07",
      "closedAt": "2025-01-07",
      "updatedAt": "2025-01-07",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Added to CISA KEV on 2025-01-07.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2020-14644",
      "title": "Oracle WebLogic Server Remote Code Execution",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2020-14644"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-18",
      "closedAt": "2024-09-18",
      "updatedAt": "2024-09-18",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2017-3506",
      "title": "Oracle WebLogic Server OS Command Injection",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2017-3506"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-03",
      "closedAt": "2024-06-03",
      "updatedAt": "2024-06-03",
      "summary": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "oracle-weblogic-server-cve-2023-21839",
      "title": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839",
      "json": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Oracle WebLogic Server",
      "tags": [
        "java",
        "oracle",
        "weblogic",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-21839"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-01",
      "closedAt": "2023-05-01",
      "updatedAt": "2023-05-01",
      "summary": "Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Added to CISA KEV on 2023-05-01.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962",
      "incidentTitle": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-24",
      "title": "CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-in-cve-2026-21962"
    },
    {
      "incident": "oracle-weblogic-server-cve-2020-2883",
      "incidentTitle": "Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-07",
      "title": "CISA added CVE-2020-2883 to the KEV catalog (due 2025-01-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-2883"
    },
    {
      "incident": "oracle-weblogic-server-cve-2020-14644",
      "incidentTitle": "Oracle WebLogic Server Remote Code Execution",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-18",
      "title": "CISA added CVE-2020-14644 to the KEV catalog (federal deadline 2024-10-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2020-14644"
    },
    {
      "incident": "oracle-weblogic-server-cve-2017-3506",
      "incidentTitle": "Oracle WebLogic Server OS Command Injection",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-03",
      "title": "CISA added CVE-2017-3506 to the KEV catalog (federal deadline 2024-06-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2017-3506"
    },
    {
      "incident": "oracle-weblogic-server-cve-2023-21839",
      "incidentTitle": "Oracle WebLogic Server: Unspecified (CVE-2023-21839)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-01",
      "title": "CISA added CVE-2023-21839 to the KEV catalog (due 2023-05-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-weblogic-server-cve-2023-21839"
    }
  ]
}