Oracle WebLogic vulnerabilities and fixes

CVEs that mention Oracle WebLogic, ranked by priority. 34 tracked.

Oracle WebLogic has 34 tracked vulnerabilities, 17 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 20. Most recent: 2026-10-20. Highest priority: CVE-2026-21962 (score 98/100).

• CVE-2026-21962 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
• CVE-2026-60291 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60292 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60294 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60672 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60696 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60698 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60977 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Component
• CVE-2026-60198 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60199 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60200 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60202 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60204 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60205 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60208 CRITICAL 9.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60206 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60293 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services
• CVE-2026-60699 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60702 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60415 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60201 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60312 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60203 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60207 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60313 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60343 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60196 HIGH 8.4 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60680 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-91502 HIGH 7.3 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60153 HIGH 7.2 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
• CVE-2026-60529 HIGH 7.2 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
• CVE-2026-60679 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
• CVE-2026-60528 HIGH 7.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
• CVE-2026-60527 HIGH 7.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)

FAQ

How do I fix Oracle WebLogic vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Oracle WebLogic being exploited right now?

Yes: 1 Oracle WebLogic CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Oracle WebLogic CVE should I patch first?

CVE-2026-21962 currently ranks highest (98/100): Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability.

← Back to latest CVEs