Oracle WebLogic Server known exploited vulnerabilities
We track 13 CVEs in Oracle WebLogic Server. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2026). CISA flags 2 of them as used in ransomware campaigns. The most recent is CVE-2026-21962, added to KEV on .
Also listed as: WebLogic Server / HTTP Server. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 13
- On CISA KEV
- 13
- Ransomware use
- 2
- Rated critical
- 8
Every Oracle WebLogic Server CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-21962 Oracle WebLogic/HTTP Server unauthenticated data access via HTTPwrite-up | [ CRITICAL ] | 10.0 | 73.2% | ||
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 74.2% | ||
| CVE-2020-2883 Oracle WebLogic Server Unspecified Vulnerability | [ CRITICAL ] | 9.8 | 94.6% | ||
| CVE-2020-14644 Oracle WebLogic Server Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 94.5% | ||
| CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability | [ HIGH ] | 7.4 | 96.0% | ||
| CVE-2023-21839 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 99.9% | ||
| CVE-2018-2628 Oracle WebLogic Server Unspecified Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.5 | 100.0% | ||
| CVE-2019-2725 Oracle WebLogic Server, Injectionransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2020-14883 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.2 | 97.7% | ||
| CVE-2020-14882 Oracle WebLogic Server Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2020-14750 Oracle WebLogic Server Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 99.2% | ||
| CVE-2015-4852 Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 95.0% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/oracle.json.
Our Oracle WebLogic Server coverage
Other Oracle products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.