Oracle Weblogic Server vulnerabilities
359 known vulnerabilities affecting oracle/weblogic_server.
Total CVEs
359
CISA KEV
16
actively exploited
Public exploits
38
Exploited in wild
34
Severity breakdown
CRITICAL107HIGH117MEDIUM131LOW4
Vulnerabilities
Page 9 of 18
CVE-2026-60679P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.0+2 more2026-08-18
CVE-2026-60679 [HIGH] CWE-287 CVE-2026-60679: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this
nvd
CVE-2019-16335P3CRITICALCVSS 9.8v12.2.1.3.02019-09-15
CVE-2019-16335 [CRITICAL] CVE-2019-16335: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
nvd
CVE-2024-20927P3HIGHCVSS 8.6v12.2.1.4.0v14.1.1.0.02024-02-17
CVE-2024-20927 [HIGH] CWE-284 CVE-2024-20927: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, at
nvd
CVE-2026-35302P3HIGHCVSS 8.3v12.2.1.4.0v14.1.1.0.02026-06-17
CVE-2026-35302 [HIGH] CWE-601 CVE-2026-35302: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. Successful attacks require human interaction from a person other
nvd
CVE-2019-2647P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+1 more2019-04-23
CVE-2019-2647 [HIGH] CVE-2019-2647: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2022-21292P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02022-01-19
CVE-2022-21292 [HIGH] CVE-2022-21292: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unau
nvd
CVE-2023-21842P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-01-18
CVE-2023-21842 [HIGH] CWE-306 CVE-2023-21842: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2026-34305P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.0+2 more2026-04-21
CVE-2026-34305 [HIGH] CWE-200 CVE-2026-34305: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of
nvd
CVE-2018-3213P3HIGHCVSS 7.5fixed in 12.2.1.3.02018-10-17
CVE-2018-3213 [HIGH] CVE-2018-3213: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Doc
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Docker Images). The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability ca
nvd
CVE-2020-2867P3HIGHCVSS 8.2v12.1.3.0.0v12.2.1.3.0+1 more2020-04-15
CVE-2020-2867 [HIGH] CVE-2020-2867: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Cont
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability ca
nvd
CVE-2018-15756P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+2 more2018-10-18
CVE-2018-15756 [HIGH] CVE-2018-15756: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and o
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious u
nvd
CVE-2020-2967P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+3 more2020-07-15
CVE-2020-2967 [HIGH] CVE-2020-2967: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attac
nvd
CVE-2019-2648P3HIGHCVSS 7.5v10.3.6.0.0v12.1.3.0.0+1 more2019-04-23
CVE-2019-2648 [HIGH] CVE-2019-2648: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulner
nvd
CVE-2021-41184P3MEDIUMCVSS 6.1v12.2.1.3.0v12.2.1.4.0+1 more2021-10-26
CVE-2021-41184 [MEDIUM] CWE-79 CVE-2021-41184: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the valu
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the val
nvd
CVE-2024-21234P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02024-10-15
CVE-2024-21234 [HIGH] CWE-862 CVE-2024-21234: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2023-22108P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02023-10-17
CVE-2023-22108 [HIGH] CVE-2023-22108: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unaut
nvd
CVE-2023-22086P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02023-10-17
CVE-2023-22086 [HIGH] CWE-200 CVE-2023-22086: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2024-21007P3HIGHCVSS 7.5v12.2.1.4.0v14.1.1.0.02024-04-16
CVE-2024-21007 [HIGH] CWE-306 CVE-2024-21007: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result
nvd
CVE-2023-21979P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-04-18
CVE-2023-21979 [HIGH] CWE-306 CVE-2023-21979: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can r
nvd
CVE-2023-21837P3HIGHCVSS 7.5v12.2.1.3.0v12.2.1.4.0+1 more2023-01-18
CVE-2023-21837 [HIGH] CWE-306 CVE-2023-21837: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can
nvd