MSRXOracle vulnerabilities being exploited
5 Oracle flaws were confirmed exploited in the wild in the past 365 days, 1 used in ransomware, across 5 products: E-Business Suite, Fusion Middleware, HTTP Server and Oracle Weblogic Server Proxy Plug-in, PeopleSoft Enterprise PeopleTools, WebLogic Server. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-08-24 | CVE-2026-21962 HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. | 2026-08-27 |
| 2026-07-15 | CVE-2026-46817 E-Business Suite Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. | 2026-07-18 |
| 2026-06-12 | CVE-2026-35273 PeopleSoft Enterprise PeopleTools ransomwareOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. | 2026-06-15 |
| 2026-06-01 | CVE-2024-21182 WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. | 2026-06-04 |
| 2025-11-21 | CVE-2025-61757 Fusion Middleware Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. | 2025-12-12 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.