WebLogic Server vulnerabilities

102 known vulnerabilities in WebLogic Server from Oracle. 101 are rated high or critical, and 16 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60153Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker w

• 7.9 High severity

  WebLogic Server: Improper Access Control

  CVE-2026-46848Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure

• 8.8 High severity

  WebLogic Server: Improper Access Control

  CVE-2026-35311Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to comp

• 8.8 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-35303Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

• 8.3 High severity

  WebLogic Server: URL Redirection to Untrusted Site

  CVE-2026-35302Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP t

• 10.0 Critical severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-35301Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to

• 9.8 Critical severity

  WebLogic Server: Deserialization of Untrusted Data

  CVE-2026-35300Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 8.8 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-35299Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

• 9.1 Critical severity

  WebLogic Server: Improper Access Control

  CVE-2026-35298Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with networ

• 10.0 Critical severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-35292Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to

• 9.9 Critical severity

  WebLogic Server: Improper Access Control

  CVE-2026-35263Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to comp

• 8.8 High severity

  WebLogic Server: URL Redirection to Untrusted Site

  CVE-2026-35259Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to

• 8.7 High severity

  WebLogic Server: URL Redirection to Untrusted Site

  CVE-2026-35258Jun 17, 2026Oracle

  Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to

• 7.5 High severity

  Oracle WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-34305Apr 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attac

• 7.2 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-34292Apr 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP

• 7.5 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-61752Oct 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 7.5 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-30762Jul 15, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 7.5 High severity

  Oracle WebLogic Server: Uncontrolled Resource Consumption

  CVE-2025-21549Jan 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromi

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2025-21535Jan 21, 2025Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server: Buffer Copy without Checking Size of Input

  CVE-2024-21274Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via H

• 7.5 High severity

  Oracle WebLogic Server: Incorrect Authorization

  CVE-2024-21260Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server: Missing Authorization

  CVE-2024-21234Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authorization

  CVE-2024-21216Oct 15, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2024-21183Jul 16, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  Oracle WebLogic Server Unspecified Exploited

  CVE-2024-21182Jul 16, 2024OracleEPSS 74.2%

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 9.1 Critical severity

  WebLogic Server: Out-of-bounds Write

  CVE-2024-21175Jul 16, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2024-21007Apr 16, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2024-21006Apr 16, 2024OracleEPSS 7.92%

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  WebLogic Server: Improper Access Control

  CVE-2024-20931Feb 17, 2024OracleEPSS 59.7%

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 8.6 High severity

  WebLogic Server: Improper Access Control

  CVE-2024-20927Feb 17, 2024Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 8.1 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-22101Oct 17, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3

• 7.5 High severity

  WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-22086Oct 17, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 9.8 Critical severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-22072Oct 17, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compro

• 9.8 Critical severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-22069Oct 17, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,

• 7.5 High severity

  WebLogic Server: Uncontrolled Resource Consumption

  CVE-2023-21996Apr 18, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with net

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-21979Apr 18, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 7.5 High severity

  WebLogic Server: Uncontrolled Resource Consumption

  CVE-2023-21964Apr 18, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-21931Apr 18, 2023OracleEPSS 82.4%

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 7.5 High severity

  WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2023-21842Jan 18, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with ne

• 7.5 High severity

  WebLogic Server: Improper Authentication

  CVE-2023-21841Jan 18, 2023Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc