Oracle
46 Oracle flaws are on CISA's list of vulnerabilities attackers have used, 4 of them added in 2026. CISA says 13 are known to be used by ransomware. The latest was added Aug 24, 2026.
46on CISA's list, all time
4added in 2026
1in the last 90 days
13used by ransomware
3zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| WebLogic Server | 12 | Jun 1, 2026 |
| Java SE | 7 | Mar 28, 2022 |
| Fusion Middleware | 6 | Nov 21, 2025 |
| E-Business Suite | 4 | Jul 15, 2026 |
| Java Runtime Environment (JRE) | 4 | May 25, 2022 |
| Agile Product Lifecycle Management (PLM) | 2 | Feb 24, 2025 |
| HTTP Server and Oracle Weblogic Server Proxy Plug-in | 1 | Aug 24, 2026 |
| PeopleSoft Enterprise PeopleTools | 1 | Jun 12, 2026 |
| ADF Faces | 1 | Sep 18, 2024 |
| Java SE and JRockit | 1 | May 12, 2023 |
Latest Oracle flaws
- HTTP Server and Oracle Weblogic Server Proxy Plug-inOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- E-Business SuiteOracle E-Business Suite Improper Privilege Management Vulnerability
- PeopleSoft Enterprise PeopleToolsOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- WebLogic ServerOracle WebLogic Server Unspecified Vulnerability
- Fusion MiddlewareOracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
- E-Business SuiteOracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
- E-Business SuiteOracle E-Business Suite Unspecified Vulnerability
- Agile Product Lifecycle Management (PLM)Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
- WebLogic ServerOracle WebLogic Server Unspecified Vulnerability
- Agile Product Lifecycle Management (PLM)Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
- WebLogic ServerOracle WebLogic Server Remote Code Execution Vulnerability
- ADF FacesOracle ADF Faces Deserialization of Untrusted Data Vulnerability
- WebLogic ServerOracle WebLogic Server OS Command Injection Vulnerability
- Fusion MiddlewareOracle Fusion Middleware Unspecified Vulnerability
- Java SE and JRockitOracle Java SE and JRockit Unspecified Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.