oracle has 2,050 CVEs on record between 2012 and 2026. Disclosure cadence is accelerating: 1734 in the last 90 days against 167 in the 90 before. The busiest recent month was October 2026 with 1013. The median CVSS is 7.5 (high), with 248 rated critical. 1% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 1283 days (12 cases). The dominant weakness classes are CWE-284 (527) and CWE-269 (164). Most affected products: PeopleSoft Enterprise PeopleTools (88), JD Edwards EnterpriseOne Tools (84), hyperion_financial_management (83).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- 1283 d median(12)
- Last 90 days
- 1734 prev 167
Weakness classes
Products
- PeopleSoft Enterprise PeopleTools 88
- JD Edwards EnterpriseOne Tools 84
- hyperion_financial_management 83
- Siebel CRM Deployment 56
- Oracle Business Intelligence Enterprise Edition 55
- Oracle Java SE 49
Worst active — by depth score
CVE-2025-61882Critical· 9.8Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration)100CVE-2019-2725Critical· 9.8Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)100CVE-2012-4681Critical· 9.8Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) usi…100CVE-2012-1723Critical· 9.8Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidential…100CVE-2025-61757Critical· 9.8Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)97
oracle vulnerabilities
CVEs affecting oracle, newest first. Open any entry for full detail, references, and exploit status.
2050 CVEsRSS
CVE-2026-101482High· 7.8Vulnerability in Oracle Secure Backup (component: Device Management and Support)
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the in…
CVE-2026-101480Medium· 5.3Vulnerability in Oracle Secure Backup (component: NDMP daemon)
Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compro…
CVE-2026-101474Medium· 5.9Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management)
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allo…
CVE-2026-101486Medium· 5.4Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with networ…
CVE-2026-101478High· 7.8Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer)
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure w…
CVE-2026-101477High· 7.8Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer)
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure w…
CVE-2026-101490Medium· 6.1Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with netwo…
CVE-2026-101485Medium· 6.5Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer)
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure w…
CVE-2026-101483Medium· 6.5Vulnerability in Oracle Secure Backup (component: Device Management and Support)
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the in…
CVE-2026-101481High· 8.8Vulnerability in Oracle Secure Backup (component: Device Management and Support)
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the in…
CVE-2026-101488Medium· 6.5Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker wi…
CVE-2026-101487Medium· 5.4Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network ac…
CVE-2026-101484Critical· 9.8Vulnerability in Oracle Secure Backup (component: Backup and Restore)
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to…
CVE-2026-101498High· 8.1Vulnerability in Oracle Trusted Answer Search (component: PLSQL package)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromi…
CVE-2026-101492Medium· 4.7Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration)
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…
CVE-2026-101489Medium· 4.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network ac…
CVE-2026-101494High· 7.7Vulnerability in Oracle REST Data Services (component: Core)
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST…
CVE-2026-101493Medium· 5.4Vulnerability in Oracle REST Data Services (component: Core)
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST…
CVE-2026-101491Medium· 5.0Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network acc…
CVE-2026-101502Medium· 5.0Vulnerability in Oracle Trusted Answer Search (component: PLSQL package)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle T…
CVE-2026-101501Critical· 9.9Vulnerability in Oracle Trusted Answer Search (component: PLSQL package)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise …
CVE-2026-101497Medium· 4.3Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework)
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileg…
CVE-2026-101495High· 8.8Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager)
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with net…
CVE-2026-101503Critical· 9.9Vulnerability in Oracle Trusted Answer Search (component: PLSQL package)
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise …
CVE-2026-101500Medium· 6.5Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions)
Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions). Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vuln…
CVE-2026-101499Critical· 9.8Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated a…
CVE-2026-101513Low· 3.8Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB)
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster. Successful at…
CVE-2026-101506High· 7.7Vulnerability in Oracle Trusted Answer Search (component: Application expert UI)
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromis…
CVE-2026-101505High· 8.7Vulnerability in Oracle Trusted Answer Search (component: Application expert UI)
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromis…
CVE-2026-101504High· 7.6Vulnerability in Oracle Trusted Answer Search (component: Application expert UI)
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromis…