Skip to content
COOEY

FEDRAMP CATALOG › Fusion Cloud

Fusion Cloud

Oracle · package F1603257882

Current status Authorized · Moderate impact · since 2026-07-07 Service modelSaaS MarketplaceRev5 · source: marketplace Security posture 33 critical 33 high 46 on KEV · 66 correlated CVEs
CMMC DOMAINS ADDRESSED
SC · System and Communications ProtectionIA · Identification and AuthenticationCM · Configuration ManagementMP · Media Protection
STATUS TIMELINE · SCD2
STATUSFROMTO
Authorized2026-07-07current
AUTHORIZATIONS
AGENCYTYPEDATE
Department of EnergyAgency2019-10-16
EXPOSED CVEs · CORRELATED TO THIS PRODUCT all exposures
SEVERITYCVETITLE
HIGHCVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
CRITICALCVE-2026-60977CVE-2026-60977: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
CRITICALCVE-2026-60990CVE-2026-60990: Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion
CRITICALCVE-2026-61001CVE-2026-61001: Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle
CRITICALCVE-2026-61003CVE-2026-61003: Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middl
CRITICALCVE-2026-61066CVE-2026-61066: Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware
CRITICALCVE-2026-61241CVE-2026-61241: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-61248CVE-2026-61248: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-61258CVE-2026-61258: Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middlewa
CRITICALCVE-2026-70905CVE-2026-70905: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (
HIGHCVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability
CRITICALCVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
HIGHCVE-2024-21182Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
CRITICALCVE-2025-61884Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
CRITICALCVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
HIGHCVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
HIGHCVE-2020-2883Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2024-21287Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
HIGHCVE-2020-14644Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2022-21445Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
HIGHCVE-2017-3506Oracle WebLogic Server OS Command Injection Vulnerability
HIGHCVE-2020-2551Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2016-3427Oracle Java SE and JRockit Unspecified Vulnerability
HIGHCVE-2023-21839Oracle WebLogic Server Unspecified Vulnerability
CRITICALCVE-2022-21587Oracle E-Business Suite Unspecified Vulnerability
HIGHCVE-2021-35587Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2010-0840Oracle JRE Unspecified Vulnerability
CRITICALCVE-2012-1710Oracle Fusion Middleware Unspecified Vulnerability
CRITICALCVE-2013-0422Oracle JRE Remote Code Execution Vulnerability
CRITICALCVE-2013-0431Oracle JRE Sandbox Bypass Vulnerability
HIGHCVE-2013-2423Oracle JRE Unspecified Vulnerability
HIGHCVE-2019-3010Oracle Solaris Privilege Escalation Vulnerability
HIGHCVE-2012-0518Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2012-5076Oracle Java SE Sandbox Bypass Vulnerability
CRITICALCVE-2013-2465Oracle Java SE Unspecified Vulnerability
HIGHCVE-2019-2616Oracle BI Publisher Unauthorized Access Vulnerability
HIGHCVE-2008-3431Oracle VirtualBox Insufficient Input Validation Vulnerability
HIGHCVE-2011-3544Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-1723Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
CRITICALCVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
HIGHCVE-2015-2590Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
HIGHCVE-2015-4902Oracle Java SE Integrity Check Vulnerability
CRITICALCVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2020-14864Oracle Business Intelligence Enterprise Edition Path Transversal
CRITICALCVE-2019-2725Oracle WebLogic Server, Injection
HIGHCVE-2012-3152Oracle Fusion Middleware Unspecified Vulnerability
HIGHCVE-2015-4852Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
HIGHCVE-2020-14750Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2020-14871Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
HIGHCVE-2020-14882Oracle WebLogic Server Remote Code Execution Vulnerability
HIGHCVE-2020-14883Oracle WebLogic Server Unspecified Vulnerability
HIGHCVE-2020-2555Oracle Multiple Products Remote Code Execution Vulnerability
CRITICALCVE-2021-40438CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig
CRITICALCVE-2020-10683CVE-2020-10683: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Enti
CRITICALCVE-2020-9546CVE-2020-9546: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
CRITICALCVE-2020-9548CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee
CRITICALCVE-2020-1938CVE-2020-1938: When using the Apache JServ Protocol (AJP), care must be taken when trusting inc
CRITICALCVE-2019-2725CVE-2019-2725: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middlewar
CRITICALCVE-2018-1273CVE-2018-1273: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older
CRITICALCVE-2016-9841CVE-2016-9841: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif
CRITICALCVE-2016-8735CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7
CRITICALCVE-2012-4681CVE-2012-4681: Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Orac
CRITICALCVE-2012-1710CVE-2012-1710: Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in