Oracle WebLogic Server vulnerabilities

65 known CVE vulnerabilities in Oracle WebLogic Server, translated and rated.

CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
CVE-2026-83038Critical
Vulnerability in Oracle WebLogic Server (TopLink Integration component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can easily compromise Oracle WebLogic Server.
CVE-2026-83021Critical
Vulnerability in Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable, allows unauthenticated attacker via HTTP to take over the server, with impact on other products (scope change). CVSS 10.0.
CVE-2026-70757Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
CVE-2026-70756Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
CVE-2026-70748Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
CVE-2026-60977Critical
Vulnerability in Oracle WebLogic Server (component: WLS Core Components) affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable flaw allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
CVE-2026-60702Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows a low-privileged attacker via T3 or IIOP to completely take over the server. The attack may impact other products (scope change). CVSS score 9.9.
CVE-2026-60698Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via IIOP to completely take over the server. CVSS score 9.8.
CVE-2026-60696Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via T3 or IIOP to completely take over the server. CVSS score 9.8.
CVE-2026-60672Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via T3 or IIOP to completely take over the server. CVSS score 9.8.
CVE-2026-60364Critical
Vulnerability in Oracle WebLogic Server Proxy Plug-in (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Unauthenticated attacker via network (HTTP) can modify data.
CVE-2026-60294Critical
In Oracle WebLogic Server (component: Core), a vulnerability can be exploited by an unauthenticated attacker over the network via SOAP. Successful attack can lead to complete server takeover.
CVE-2026-60292Critical
In Oracle WebLogic Server (component: Core), a vulnerability can be exploited by an unauthenticated attacker over the network via HTTP. Successful attack can lead to complete server takeover.
CVE-2026-60291Critical
Critical vulnerability in Oracle WebLogic Server (Core component) allows an unauthenticated attacker to remotely take over the server via network using HTTP. The attack does not impact other products (no scope change).
CVE-2026-60208Critical
Oracle WebLogic Server (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain an easily exploitable vulnerability allowing an unauthenticated attacker unauthorized access to critical data and the ability to modify or delete it.
CVE-2026-60206Critical
Vulnerability in Oracle WebLogic Server (component: Core) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. A low-privileged attacker can remotely compromise the server via SAML, with potential impact on additional products (scope change).
CVE-2026-60205Critical
In Oracle WebLogic Server (component: Core), a vulnerability can be exploited by an unauthenticated attacker over the network via TCP. Successful attack can lead to complete server takeover.
CVE-2026-60204Critical
Critical vulnerability in Oracle WebLogic Server (Core component) allows an unauthenticated attacker to remotely take over the server via network using T3 and IIOP protocols. The attack does not impact other products (no scope change).
CVE-2026-60202Critical
Critical vulnerability in Oracle WebLogic Server (Core component) allows an unauthenticated attacker to remotely take over the server via network using T3 and IIOP protocols. The attack does not impact other products (no scope change).
CVE-2026-60200Critical
Critical vulnerability in Oracle WebLogic Server (Core component) allows an unauthenticated attacker to remotely take over the server via network using SOAP. The attack does not impact other products (no scope change).
CVE-2026-60199Critical
Vulnerability in Oracle WebLogic Server allows an unauthenticated attacker via HTTP to take over the server. Exploitation is easy and requires no privileges.
CVE-2026-60198Critical
In Oracle WebLogic Server (component: Core), a vulnerability can be exploited by an unauthenticated attacker over the network via T3 and IIOP protocols. Successful attack can lead to complete server takeover.
CVE-2023-21839HighActively exploited
Vulnerability in Oracle WebLogic Server (component: Core) affecting versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server, resulting in unauthorized access to critical data. CVSS 3.1 Base Score 7.5.
CVE-2020-14750CriticalActively exploited
Vulnerability in the Oracle WebLogic Server Console (Oracle Fusion Middleware) affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it and take over the server.
CVE-2020-14883HighActively exploited
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server.
CVE-2020-14882CriticalActively exploited
Vulnerability in the Oracle WebLogic Server Console (Oracle Fusion Middleware) affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it and take over the server.
CVE-2020-14644CriticalActively exploited
Vulnerability in Oracle WebLogic Server (component: Core) affects versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. Easily exploitable by unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server, resulting in takeover. CVSS 3.1 Base Score 9.8.
CVE-2020-2883CriticalActively exploited
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8.
CVE-2020-2551CriticalActively exploited
Vulnerability in Oracle WebLogic Server (component: WLS Core Components) allows an unauthenticated attacker with network access via IIOP to compromise the server. Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0. CVSS 3.0 Base Score 9.8.
CVE-2019-2725CriticalActively exploited
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8.
CVE-2018-2628CriticalActively exploited
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.
CVE-2017-10352Critical
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. The attacker can cause hangs or frequent crashes of the server and gain unauthorized access to data.
CVE-2017-10137Critical
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. Affected versions are 10.3.6.0 and 12.1.3.0.
CVE-2017-3248Critical
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access to compromise the server. Affected versions are 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1.
CVE-2016-5535Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows remote attackers to affect confidentiality, integrity, and availability.
CVE-2016-5531Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.
CVE-2016-3586Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability.
CVE-2016-3510Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability.
CVE-2016-3499Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.
CVE-2016-0638Critical
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
CVE-2026-60699High
Vulnerability in Oracle WebLogic Server (component: Core) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker can remotely access data via T3, IIOP, potentially impacting additional products.
CVE-2026-60680High
Vulnerability in Oracle WebLogic Server (component: Core) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker can remotely compromise the system via HTTP, affecting integrity and availability. Attacks can result in unauthorized creation, deletion, or modification of data and complete denial of service.
CVE-2026-60679High
Vulnerability in Oracle WebLogic Server (component: Core) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker can remotely compromise the system via T3, IIOP under difficult conditions. Successful attacks can result in takeover of Oracle WebLogic Server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS