# Oracle WebLogic Server vulnerabilities Source: https://junglewise.ai/threats/technologies/weblogic-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/weblogic-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 72 vulnerabilities in Oracle WebLogic Server: 0 in the last 7 days and 19 in the last 90 days, 43 of them critical and 13 exploited in the wild. The most recent, CVE-2026-91502, was published on 20 October 2026. 5 vulnerabilities in the last four weeks, level on the four before (5). 3 critical against 5. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 19 - All time: 72 (43 critical, 13 exploited in the wild) ## About Oracle WebLogic Server Java-based application server for deploying and managing enterprise applications. ## Latest Oracle WebLogic Server vulnerabilities - [CVE-2026-91502: Oracle WebLogic Server data modification and DoS in Core](https://junglewise.ai/threats/cve-2026-91502-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (high, CVSS 7.3, published 20 Oct 2026) - [CVE-2026-91323: Oracle WebLogic Server remote code execution in Core](https://junglewise.ai/threats/cve-2026-91323-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-87302: Oracle WebLogic Server unauthorized data access in Core](https://junglewise.ai/threats/cve-2026-87302-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.1, published 20 Oct 2026) - [CVE-2026-83399: Oracle WebLogic Server remote code execution in Core](https://junglewise.ai/threats/cve-2026-83399-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-101515: Oracle WebLogic Server information disclosure in third-party jars](https://junglewise.ai/threats/cve-2026-101515-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (medium, CVSS 5.9, published 20 Oct 2026) - [CVE-2026-83038: Oracle WebLogic Server privilege escalation in TopLink Integration](https://junglewise.ai/threats/cve-2026-83038-oracle-weblogic-server-privilege-escalation-in-toplink) (critical, CVSS 9.9, published 15 Sep 2026) - [CVE-2026-83021: Oracle WebLogic Server remote code execution in Web Container](https://junglewise.ai/threats/cve-2026-83021-oracle-weblogic-server-remote-code-execution-in-web-container) (critical, CVSS 10, published 15 Sep 2026) - [CVE-2026-70757: Oracle WebLogic Server unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-70757-oracle-weblogic-server-unauthenticated-remote-code-execution) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-70756: Oracle WebLogic Server remote code execution in T3/IIOP](https://junglewise.ai/threats/cve-2026-70756-oracle-weblogic-server-remote-code-execution-in-t3-iiop) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-70748: Oracle WebLogic Server remote code execution in Core](https://junglewise.ai/threats/cve-2026-70748-oracle-weblogic-server-remote-code-execution-in-core) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-60977: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components)…](https://junglewise.ai/threats/cve-2026-60977-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-60702: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60702-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-60699: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60699-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (high, CVSS 8.6, published 18 Aug 2026) - [CVE-2026-60698: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60698-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-60696: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60696-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-60680: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60680-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-60679: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60679-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (high, CVSS 7.5, published 18 Aug 2026) - [CVE-2026-60672: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60672-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-60415: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions…](https://junglewise.ai/threats/cve-2026-60415-vulnerability-in-the-oracle-weblogic-server-product-of-oracle) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-60529: Oracle WebLogic Server compromise in Console component](https://junglewise.ai/threats/cve-2026-60529-oracle-weblogic-server-compromise-in-console-component) (high, CVSS 7.2, published 21 Jul 2026) - [CVE-2026-60528: Oracle WebLogic Server data integrity vulnerability in Console](https://junglewise.ai/threats/cve-2026-60528-oracle-weblogic-server-data-integrity-vulnerability-in-console) (high, CVSS 7.6, published 21 Jul 2026) - [CVE-2026-60527: Oracle WebLogic Server information disclosure in Console](https://junglewise.ai/threats/cve-2026-60527-oracle-weblogic-server-information-disclosure-in-console) (high, CVSS 7.1, published 21 Jul 2026) - [CVE-2026-60343: Oracle WebLogic Server compromise in Core component](https://junglewise.ai/threats/cve-2026-60343-oracle-weblogic-server-compromise-in-core-component) (high, CVSS 8.8, published 21 Jul 2026) - [CVE-2026-60313: Oracle WebLogic Server takeover via RMI in Core component](https://junglewise.ai/threats/cve-2026-60313-oracle-weblogic-server-takeover-via-rmi-in-core-component) (high, CVSS 8.8, published 21 Jul 2026) - [CVE-2026-60312: Oracle WebLogic Server remote compromise in Core component](https://junglewise.ai/threats/cve-2026-60312-oracle-weblogic-server-remote-compromise-in-core-component) (high, CVSS 8.1, published 21 Jul 2026) ## Most severe Oracle WebLogic Server vulnerabilities - [CVE-2020-2883: Oracle WebLogic Server Unspecified Vulnerability](https://junglewise.ai/threats/cve-2020-2883-oracle-weblogic-server-unspecified-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 7 Jan 2025) - [CVE-2020-14644: Oracle WebLogic Server Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-14644-oracle-weblogic-server-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 18 Sep 2024) - [CVE-2020-2551: Oracle Fusion Middleware Unspecified Vulnerability](https://junglewise.ai/threats/cve-2020-2551-oracle-fusion-middleware-unspecified-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 16 Nov 2023) - [CVE-2018-2628: Oracle WebLogic Server Unspecified Vulnerability](https://junglewise.ai/threats/cve-2018-2628-oracle-weblogic-server-unspecified-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 8 Sep 2022) - [CVE-2019-2725: Oracle WebLogic Server, Injection](https://junglewise.ai/threats/cve-2019-2725-oracle-weblogic-server-injection) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) - [CVE-2020-14882: Oracle WebLogic Server Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-14882-oracle-weblogic-server-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2020-14750: Oracle WebLogic Server Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-14750-oracle-weblogic-server-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2015-4852: Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability](https://junglewise.ai/threats/cve-2015-4852-oracle-weblogic-server-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2024-21182: Oracle WebLogic Server unspecified vulnerability in Core component](https://junglewise.ai/threats/cve-2024-21182-oracle-weblogic-server-unspecified-vulnerability-in-core) (critical, exploited in the wild, CVSS 7.5, published 1 Jun 2026) - [CVE-2023-21839: Oracle WebLogic Server Unspecified Vulnerability](https://junglewise.ai/threats/cve-2023-21839-oracle-weblogic-server-unspecified-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 1 May 2023) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, level on the four before (5). 3 critical against 5. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 9 | 5 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 5 | 5 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 5 | 3 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Oracle technologies - [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server): 163 vulnerabilities - [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management): 142 vulnerabilities - [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon): 130 vulnerabilities - [Oracle MySQL Cluster](https://junglewise.ai/threats/technologies/mysql-cluster): 129 vulnerabilities - [Oracle Coherence](https://junglewise.ai/threats/technologies/coherence): 113 vulnerabilities - [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite): 110 vulnerabilities - [Oracle WebCenter Content](https://junglewise.ai/threats/technologies/webcenter-content): 110 vulnerabilities - [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search): 104 vulnerabilities - [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager): 102 vulnerabilities - [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools): 101 vulnerabilities - [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools): 101 vulnerabilities - [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se): 92 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Oracle WebLogic Server vulnerabilities", https://junglewise.ai/threats/technologies/weblogic-server, 9 November 2026.