Oracle Fusion Middleware vulnerabilities

313 CVEs affecting Oracle Fusion Middleware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-35252, published 2026-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-3152: Oracle Fusion Middleware Unspecified Vulnerability, published 2012-10-16. Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 98.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via…
CVE-2012-1710: Oracle Fusion Middleware Unspecified Vulnerability, published 2012-05-03. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 7.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2012-0518: Oracle Fusion Middleware Unspecified Vulnerability, published 2012-10-16. Medium severity, CVSS 4.7. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 4.7% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to…
CVE-2012-3153, published 2012-10-16. Medium severity, CVSS 6.4. EPSS: 98.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via…
CVE-2013-3763, published 2013-07-17. Medium severity, CVSS 5.5. EPSS: 59.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown…
CVE-2013-1559, published 2013-04-17. Medium severity, CVSS 4.0. EPSS: 58.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors…
CVE-2010-1622, published 2010-06-21. Medium severity, CVSS 6.0. EPSS: 52% chance of exploitation in the next 30 days. SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing…
CVE-2014-2424, published 2014-04-16. Medium severity, CVSS 4.0. EPSS: 48.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.
CVE-2014-4210, published 2014-07-17. Medium severity, CVSS 5.0. EPSS: 38.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web…
CVE-2013-3827, published 2013-10-16. Medium severity, CVSS 5.0. EPSS: 32.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0,…

Latest

CVE-2026-35252, published 2026-04-21. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API). Supported versions that are affected are 12.2.1.4.0 and 12.1.3.0.0. Difficult to…
CVE-2026-35232, published 2026-04-21. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low…
CVE-2024-21215, published 2024-10-15. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable…
CVE-2024-21205, published 2024-10-15. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily exploitable…
CVE-2024-21192, published 2024-10-15. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). The supported version that is affected is 12.2.1.4.0. Easily…
CVE-2024-21191, published 2024-10-15. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin). The supported version that is affected is 12.2.1.4.0.…
CVE-2024-21190, published 2024-10-15. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily…
CVE-2023-21994, published 2023-07-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authenticator App). Supported versions that are affected are Prior to 11.1.2.3.1.…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2020-5421, published 2020-09-19. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed…