What’s Vulnerable › Products

Oracle Corporation Oracle HTTP Server vulnerabilities

116 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your Oracle Corporation Oracle HTTP Server version is affected

Exploited Oracle Corporation Oracle HTTP Server vulnerabilities

• CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
• CVE-2021-4034 — Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
• CVE-2021-40438 — Apache HTTP Server-Side Request Forgery (SSRF)
• CVE-2019-0211 — Apache HTTP Server Privilege Escalation Vulnerability

Latest Oracle Corporation Oracle HTTP Server vulnerabilities

• CVE-2026-91473 — (CVSS 7.8)
• CVE-2026-91419 — (CVSS 7.8)
• CVE-2026-87347 — (CVSS 9.6)
• CVE-2026-87346 — (CVSS 8.7)
• CVE-2026-60530 — (CVSS 7.8)
• CVE-2026-60454 — (CVSS 7.8)
• CVE-2026-60438 — (CVSS 9.1)
• CVE-2026-60431 — (CVSS 8.6)
• CVE-2026-60365 — (CVSS 10.0)
• CVE-2026-60364 — (CVSS 9.8)
• CVE-2026-60363 — (CVSS 9.8)
• CVE-2026-34291 — (CVSS 8.7)
• CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (CVSS 10.0) — exploited
• CVE-2025-21498 — (CVSS 5.3)
• CVE-2024-20991 — (CVSS 5.3)
• CVE-2023-22019 — (CVSS 7.5)
• CVE-2022-21593 — (CVSS 7.1)
• CVE-2020-35169 — (CVSS 9.8)
• CVE-2020-35168 — (CVSS 9.8)
• CVE-2020-35167 — (CVSS 9.8)
• CVE-2020-35166 — (CVSS 9.8)
• CVE-2020-35164 — (CVSS 8.1)
• CVE-2020-35163 — (CVSS 9.8)
• CVE-2020-29508 — (CVSS 9.8)
• CVE-2020-29507 — (CVSS 9.8)