Oracle WebLogic Server vulnerabilities

364 known vulnerabilities, 16 confirmed exploited in the wild (CISA KEV), 67 published in the last 12 months.

Exploited Oracle WebLogic Server vulnerabilities

CVE-2024-21182 — Oracle WebLogic Server Unspecified Vulnerability
CVE-2020-11023 — JQuery Cross-Site Scripting (XSS) Vulnerability
CVE-2020-2883 — Oracle WebLogic Server Unspecified Vulnerability
CVE-2020-14644 — Oracle WebLogic Server Remote Code Execution Vulnerability
CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability
CVE-2020-2551 — Oracle Fusion Middleware Unspecified Vulnerability
CVE-2023-21839 — Oracle WebLogic Server Unspecified Vulnerability
CVE-2018-2628 — Oracle WebLogic Server Unspecified Vulnerability
CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability
CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
CVE-2019-2725 — Oracle WebLogic Server, Injection
CVE-2020-14883 — Oracle WebLogic Server Unspecified Vulnerability
CVE-2020-14882 — Oracle WebLogic Server Remote Code Execution Vulnerability
CVE-2020-14750 — Oracle WebLogic Server Remote Code Execution Vulnerability
CVE-2017-5638 — Apache Struts Remote Code Execution Vulnerability
CVE-2015-4852 — Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

CVE-2026-91502 — (CVSS 7.3)
CVE-2026-91323 — (CVSS 9.8)
CVE-2026-83399 — (CVSS 9.8)
CVE-2026-101515 — (CVSS 5.9)
CVE-2026-87302 — (CVSS 9.1)
CVE-2026-83038 — (CVSS 9.9)
CVE-2026-83021 — (CVSS 10.0)
CVE-2026-70757 — (CVSS 9.8)
CVE-2026-70756 — (CVSS 9.8)
CVE-2026-70748 — (CVSS 9.8)
CVE-2026-60977 — (CVSS 9.8)
CVE-2026-60702 — (CVSS 9.9)
CVE-2026-60699 — (CVSS 8.6)
CVE-2026-60698 — (CVSS 9.8)
CVE-2026-60696 — (CVSS 9.8)
CVE-2026-60680 — (CVSS 8.1)
CVE-2026-60679 — (CVSS 7.5)
CVE-2026-60672 — (CVSS 9.8)
CVE-2026-60415 — (CVSS 8.1)
CVE-2026-60529 — (CVSS 7.2)
CVE-2026-60528 — (CVSS 7.6)
CVE-2026-60527 — (CVSS 7.1)
CVE-2026-60343 — (CVSS 8.8)
CVE-2026-60313 — (CVSS 8.8)
CVE-2026-60312 — (CVSS 8.1)