Oracle Weblogic Server vulnerabilities
359 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
359
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL107HIGH117MEDIUM131LOW4
Vulnerabilities
Page 4 of 18
CVE-2026-35292P2CRITICALCVSS 10.0v14.1.2.0.0v15.1.1.0.02026-06-17
CVE-2026-35292 [CRITICAL] CWE-306 CVE-2026-35292: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may sig
nvd
CVE-2022-21306P2CRITICALCVSS 9.8v12.1.3.0.0v12.2.1.3.0+2 more2022-01-19
CVE-2022-21306 [CRITICAL] CVE-2022-21306: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerabi
nvd
CVE-2021-2075P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-01-20
CVE-2021-2075 [CRITICAL] CVE-2021-2075: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attack
nvd
CVE-2026-60205P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.2.0.02026-07-21
CVE-2026-60205 [CRITICAL] CWE-306 CVE-2026-60205: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result i
nvd
CVE-2021-1994P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.02021-01-20
CVE-2021-1994 [CRITICAL] CVE-2021-1994: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2021-2047P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+1 more2021-01-20
CVE-2021-2047 [CRITICAL] CVE-2021-2047: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Com
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulne
nvd
CVE-2020-14859P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2020-10-21
CVE-2020-14859 [CRITICAL] CVE-2020-14859: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks
nvd
CVE-2010-2375P3MEDIUMCVSS 6.4PoCv10.3.2.0.0v10.3.3.0.02010-07-13
CVE-2010-2375 [MEDIUM] CVE-2010-2375: Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebL
Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
nvd
CVE-2026-60977P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+1 more2026-08-18
CVE-2026-60977 [CRITICAL] CWE-284 CVE-2026-60977: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60292P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.02026-07-21
CVE-2026-60292 [CRITICAL] CWE-306 CVE-2026-60292: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2026-60291P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60291 [CRITICAL] CWE-306 CVE-2026-60291: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2026-60199P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60199 [CRITICAL] CWE-306 CVE-2026-60199: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2017-10352P2CRITICALCVSS 9.9v10.3.6.0.0v12.1.3.0.0+3 more2017-10-19
CVE-2017-10352 [CRITICAL] CVE-2017-10352: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. W
nvd
CVE-2021-23450P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.02021-12-17
CVE-2021-23450 [CRITICAL] CWE-1321 CVE-2021-23450: All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
nvd
CVE-2020-2546P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.02020-01-15
CVE-2020-2546 [CRITICAL] CVE-2020-2546: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Applicat
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerabi
nvd
CVE-2017-10137P2CRITICALCVSS 10.0v10.3.6.0.0v12.1.3.0.02017-08-08
CVE-2017-10137 [CRITICAL] CVE-2017-10137: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JND
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, att
nvd
CVE-2026-35300P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-06-17
CVE-2026-35300 [CRITICAL] CWE-502 CVE-2026-35300: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Support
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise WebLogic Server. Successful attacks of this vulnerability c
nvd
CVE-2026-70748P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-09-15
CVE-2026-70748 [CRITICAL] CWE-287 CVE-2026-70748: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-70757P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-09-15
CVE-2026-70757 [CRITICAL] CWE-287 CVE-2026-70757: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-70756P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-09-15
CVE-2026-70756 [CRITICAL] CWE-287 CVE-2026-70756: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd