Oracle Weblogic Server vulnerabilities
359 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
359
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL107HIGH117MEDIUM131LOW4
Vulnerabilities
Page 5 of 18
CVE-2026-60696P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-08-18
CVE-2026-60696 [CRITICAL] CWE-306 CVE-2026-60696: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60672P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-08-18
CVE-2026-60672 [CRITICAL] CWE-306 CVE-2026-60672: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60698P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-08-18
CVE-2026-60698 [CRITICAL] CWE-306 CVE-2026-60698: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2026-60294P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60294 [CRITICAL] CWE-306 CVE-2026-60294: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2026-60202P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60202 [CRITICAL] CWE-306 CVE-2026-60202: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60204P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60204 [CRITICAL] CWE-306 CVE-2026-60204: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60198P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60198 [CRITICAL] CWE-306 CVE-2026-60198: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of th
nvd
CVE-2026-60200P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60200 [CRITICAL] CWE-306 CVE-2026-60200: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this v
nvd
CVE-2021-2108P2CRITICALCVSS 9.8v12.1.3.0.02021-01-20
CVE-2021-2108 [CRITICAL] CVE-2021-2108: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Com
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in take
nvd
CVE-2021-2064P2CRITICALCVSS 9.8v12.1.3.0.02021-01-20
CVE-2021-2064 [CRITICAL] CVE-2021-2064: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Com
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in take
nvd
CVE-2021-2136P2CRITICALCVSS 9.8v12.1.3.0.0v12.2.1.3.0+2 more2021-04-22
CVE-2021-2136 [CRITICAL] CVE-2021-2136: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerabi
nvd
CVE-2021-35617P2CRITICALCVSS 9.8v12.1.3.0.0v12.2.1.3.0+2 more2021-10-20
CVE-2021-35617 [CRITICAL] CVE-2021-35617: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherenc
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks
nvd
CVE-2021-2382P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2382 [CRITICAL] CVE-2021-2382: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attac
nvd
CVE-2021-2397P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+3 more2021-07-21
CVE-2021-2397 [CRITICAL] CVE-2021-2397: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks o
nvd
CVE-2026-83038P2CRITICALCVSS 9.9v12.2.1.4.0v14.1.1.0.0+2 more2026-09-15
CVE-2026-83038 [CRITICAL] CWE-284 CVE-2026-83038: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vul
nvd
CVE-2026-60206P2CRITICALCVSS 9.9v12.2.1.4.0v14.1.1.0.0+2 more2026-07-21
CVE-2026-60206 [CRITICAL] CWE-306 CVE-2026-60206: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in
nvd
CVE-2019-2890P2HIGHCVSS 7.2v10.3.6.0.0v12.1.3.0.0+1 more2019-10-16
CVE-2019-2890 [HIGH] CVE-2019-2890: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can r
nvd
CVE-2020-11987P2HIGHCVSS 8.2v12.2.1.3.0v12.2.1.4.0+1 more2021-02-24
CVE-2020-11987 [HIGH] CWE-20 CVE-2020-11987: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
nvd
CVE-2020-2801P2CRITICALCVSS 9.8v10.3.6.0.0v12.1.3.0.0+2 more2020-04-15
CVE-2020-2801 [CRITICAL] CVE-2020-2801: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). S
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulne
nvd
CVE-2024-21181P2CRITICALCVSS 9.8v12.2.1.4.0v14.1.1.0.02024-07-16
CVE-2024-21181 [CRITICAL] CVE-2024-21181: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in t
nvd