Oracle WebLogic Server Proxy Plug-In vulnerabilities

16 CVEs affecting Oracle WebLogic Server Proxy Plug-In, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60365, published 2026-07-21.

More from Oracle.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability, published 2026-01-20. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2026-08-24. EPSS: 73.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server…
• CVE-2020-5360, published 2020-12-16. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability resulting…
• CVE-2020-5359, published 2020-12-16. Medium severity, CVSS 5.8. EPSS: 1.3% chance of exploitation in the next 30 days. Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to…
• CVE-2020-29508, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability.
• CVE-2020-29506, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.
• CVE-2020-26185, published 2022-06-01. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability.
• CVE-2020-29507, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation Vulnerability.
• CVE-2020-35163, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Values Vulnerability.
• CVE-2020-35167, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
• CVE-2020-35169, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability.

Latest

• CVE-2026-60365, published 2026-07-21. Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is…
• CVE-2026-60364, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are…
• CVE-2020-35168, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
• CVE-2020-35166, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
• CVE-2020-35164, published 2022-07-11. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.