WebLogic Server vulnerabilities | LiveThreat CVE Feed

App Server

WebLogic Server

by Oracle · last CVE Oct 20, 2026

On CISA KEVExploited in the wildRansomware-linked

359

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities359 In the news5 Timeline

Severity mix

Critical 107High 112Medium 124Low 4

Severity

All severities359 Critical107 High112 Medium124 Low4

Exploitation

On CISA KEV16 Exploited in the wild16

Watch

Add WebLogic Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-91502	7.3	0%	Oct 20	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2019-10086	7.3	29%	Aug 20	In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 10.3.6.0.0
CVE-2026-60529	7.2	0%	Jul 21	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) Affected: 14.1.2.0.0; 15.1.1.0.0
CVE-2026-60153	7.2	0%	Jul 21	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) Affected: 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0
CVE-2026-34292	7.2	0%	Apr 21	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core) Affected: 12.2.1.4.0; 14.1.1.0.0
CVE-2021-2109	7.2	70%	Jan 20	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0
CVE-2020-2963	7.2	1%	Apr 15	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services) Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-2798	7.2	8%	Apr 15	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services) Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0
CVE-2020-2549	7.2	2%	Jan 15	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components) Affected: 10.3.6.0.0
CVE-2019-2890	7.2	37%	Oct 16	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services) Affected: 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0
CVE-2017-3531	7.2	2%	Apr 24	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Servlet Runtime) Affected: 12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0
CVE-2026-60527	7.1	0%	Jul 21	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console) Affected: 14.1.2.0.0; 15.1.1.0.0