Oracle Multiple Products Remote Code Execution Vulnerability
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
- Vendor
- Oracle
- Product
- Multiple Products
- CVSS
- 9.8
- EPSS (exploit probability)
- 97.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2020-2555 being exploited?
Yes. CISA added CVE-2020-2555 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 97.1% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
What to do
CISA required actionApply updates per vendor instructions.
US federal civilian agencies must remediate by (181 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other Oracle CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-21962 Oracle WebLogic/HTTP Server unauthenticated data access via HTTPwrite-up | [ CRITICAL ] | 10.0 | 73.2% | |
| CVE-2026-46817 Oracle E-Business Suite Payments improper privilege management (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 0.8% | |
| CVE-2026-35273 Oracle PeopleSoft PeopleTools missing authentication allows unauthenticated takeoverransomware usewrite-up | [ CRITICAL ] | 9.8 | 96.7% | |
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 74.2% | |
| CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | [ CRITICAL ] | 9.8 | 88.6% | |
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 7.5 | 95.9% | |
| CVE-2025-61882 Oracle E-Business Suite BI Publisher Integration unauth RCEransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.7% | |
| CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | [ HIGH ] | 8.8 | 3.9% |