Oracle Utilities Framework vulnerabilities

38 CVEs affecting Oracle Utilities Framework, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21924, published 2026-01-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2020-2555: Oracle Multiple Products Remote Code Execution Vulnerability, published 2020-01-15. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2019-10173, published 2019-07-23. Critical severity, CVSS 9.8. EPSS: 95% chance of exploitation in the next 30 days. It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote…
CVE-2020-14756, published 2021-01-20. Critical severity, CVSS 9.8. EPSS: 74.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and…
CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2020-25649, published 2020-12-03. High severity, CVSS 7.5. EPSS: 17.7% chance of exploitation in the next 30 days. A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from…
CVE-2021-39141, published 2021-08-23. High severity, CVSS 8.5. EPSS: 16.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2018-8088, published 2018-03-20. Critical severity, CVSS 9.8. EPSS: 14.7% chance of exploitation in the next 30 days. org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module…

Latest

CVE-2026-21924, published 2026-01-20. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General). Supported versions that are affected are 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1,…
CVE-2020-36518, published 2022-03-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2021-39152, published 2021-08-23. High severity, CVSS 8.5. EPSS: 11.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39150, published 2021-08-23. High severity, CVSS 8.5. EPSS: 3.4% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not…
CVE-2021-39140, published 2021-08-23. Medium severity, CVSS 6.3. EPSS: 5.9% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on…
CVE-2021-39154, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39153, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.5% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39151, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…
CVE-2021-39149, published 2021-08-23. High severity, CVSS 8.5. EPSS: 4.7% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only…