Oracle WebLogic Server vulnerabilities

52 known vulnerabilities in Oracle WebLogic Server from Oracle. 52 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60153Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker w

• 7.5 High severity

  Oracle WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-34305Apr 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attac

• 7.2 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-34292Apr 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP

• 7.5 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-61752Oct 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 7.5 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-30762Jul 15, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 7.5 High severity

  Oracle WebLogic Server: Uncontrolled Resource Consumption

  CVE-2025-21549Jan 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromi

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-21535Jan 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server: Buffer Copy without Checking Size of Input

  CVE-2024-21274Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via H

• 7.5 High severity

  Oracle WebLogic Server: Incorrect Authorization

  CVE-2024-21260Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server: Missing Authorization

  CVE-2024-21234Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authorization

  CVE-2024-21216Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server: Missing Authorization

  CVE-2024-21215Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP