Oracle
- Exploited flaws
- 46in 17 products
- Added to CISA's list in 2026
- 45 in 2025
- Used by ransomware
- 13of 46, says CISA
- Disclosure to CISA's list
- 1575 daysmedian; 4 of 39 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2008 | 1 |
| 2009 | 0 |
| 2010 | 1 |
| 2011 | 1 |
| 2012 | 7 |
| 2013 | 4 |
| 2014 | 0 |
| 2015 | 3 |
| 2016 | 1 |
| 2017 | 2 |
| 2018 | 1 |
| 2019 | 3 |
| 2020 | 9 |
| 2021 | 1 |
| 2022 | 2 |
| 2023 | 1 |
| 2024 | 3 |
| 2025 | 3 |
| 2026 | 3 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| WebLogic Server | 12 | 2021-11-03 | 2026-06-01 |
| Java SE | 7 | 2022-03-03 | 2022-03-28 |
| Fusion Middleware | 6 | 2021-11-03 | 2025-11-21 |
| E-Business Suite | 4 | 2023-02-02 | 2026-07-15 |
| Java Runtime Environment (JRE) | 4 | 2022-05-25 | 2022-05-25 |
| Agile Product Lifecycle Management (PLM) | 2 | 2024-11-21 | 2025-02-24 |
Latest on CISA's list
- Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- Oracle E-Business Suite Improper Privilege Management Vulnerability
- Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- Oracle WebLogic Server Unspecified Vulnerability
- Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
- Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
- Oracle E-Business Suite Unspecified Vulnerability
- Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
- Oracle WebLogic Server Unspecified Vulnerability
- Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
In the news
- Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
- Hackers now scanning systems for recently-patched Oracle flaw
- Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.