FAIL › dossier
Oracle
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 20%
Oracle is a major enterprise software provider with a historically poor security track record, frequently releasing critical RCE and authentication bypass vulnerabilities in its core products like WebLogic Server and Java Runtime Environment. The internal failure history shows a consistent pattern of unauthenticated attackers exploiting missing authentication, deserialization flaws, and unpatched SSRF vulnerabilities to achieve full system compromise.
PROFILE
CategoryEnterprise Software / Cloud ServicesWhat they doOracle Corporation offers products and services that build, run and support enterprise information technology frameworks worldwide, including Oracle cloud software as a service offerings like Oracle Fusion cloud enterprise resource planning ERP.
Websitehttps://www.oracle.com ↗
SECURITY POSTURE
Oracle has a historically poor security posture characterized by a high volume of critical and high-severity remote code execution (RCE) vulnerabilities across its Java Runtime Environment, WebLogic Server, and E-Business Suite products. The internal failure history reveals a pattern of unauthenticated attackers exploiting missing authentication, deserialization flaws, and OS command injection vulnerabilities to achieve full system compromise.
Notable failures
- CVE-2026-35273: PeopleTools lacks authentication for critical functions enabling full system control
- CVE-2025-61884: E-Business Suite unpatched SSRF actively exploited in the wild
- CVE-2025-61882: BI Publisher Integration unauthenticated HTTP takeover leading to full compromise
- CVE-2024-20953: Agile PLM deserialization vulnerability allowing low-privileged compromise
- CVE-2020-14644: WebLogic Server deserialization vulnerability allowing unauthenticated T3/IIOP takeover
- CVE-2020-14750: WebLogic Server unspecified vulnerability allowing unauthenticated RCE
Patterns: Repeated unauthenticated remote code execution (RCE) vulnerabilities in WebLogic Server and Java Runtime Environment; Missing authentication for critical functions in PeopleTools and Fusion Middleware; Deserialization of untrusted data leading to system compromise; Unpatched SSRF and OS command injection vulnerabilities actively exploited in the wild
FAILURE HISTORY · 60
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-02-10 | CVE-2017-10271 | critical | Oracle WebLogic Server had a remotely exploitable code execution vulnerability actively linked to ransomware attacks. |
| 2026-08-18 | CVE-2026-61241 | critical | An unauthenticated LDAP attacker can take over Oracle Internet Directory in versions 12.2.1.4.0 and 14.1.2.1.0. |
| 2026-08-18 | CVE-2026-61258 | critical | An unauthenticated LDAP vulnerability in Oracle Internet Directory allows remote takeover of the server. |
| 2026-08-18 | CVE-2026-60977 | critical | Unauthenticated remote RMI exploitation allows full takeover of Oracle WebLogic Server instances. |
| 2026-06-12 | CVE-2026-35273 | critical | Oracle PeopleTools lacks authentication for critical functions, enabling unauthenticated attackers to gain full system control. |
| 2025-10-20 | CVE-2025-61884 | critical | Oracle E-Business Suite's unpatched SSRF vulnerability in Oracle Configurator was actively exploited in the wild without authentication, enabling remote code execution and ransomware attacks. |
| 2025-10-06 | CVE-2025-61882 | critical | An unauthenticated remote attacker can take over Oracle E-Business Suite's BI Publisher Integration component via HTTP, leading to full system compromise. |
| 2024-06-03 | CVE-2017-3506 | high | Oracle WebLogic Server was exploited in the wild via CVE-2017-3506, enabling remote code execution through malicious XML requests. |
| 2022-05-25 | CVE-2013-0431 | critical | A remote sandbox bypass in Oracle JRE allowed attackers to execute arbitrary code, leading to ransomware outbreaks. |
| 2022-05-25 | CVE-2013-0422 | critical | Oracle JRE applet permission flaw allowed remote attackers to execute arbitrary commands on vulnerable systems. |
| 2022-05-25 | CVE-2012-1710 | critical | Oracle Fusion Middleware's WebCenter Forms Recognition component suffered an unspecified vulnerability allowing remote attackers to compromise confidentiality, integrity, and availability. |
| 2022-03-28 | CVE-2012-5076 | high | Oracle Java SE shipped with default configurations allowing sandbox bypass via untrusted applets, enabling arbitrary code execution. |
| 2021-11-03 | CVE-2020-2555 | high | Unauthenticated remote code execution flaw in multiple Oracle products allowed attackers to take over systems via T3 or HTTP. |
| 2021-11-03 | CVE-2020-14882 | high | Oracle WebLogic Server suffered a remote code execution vulnerability (CVE-2020-14882) that was actively exploited in the wild. |
| 2021-11-03 | CVE-2020-14750 | high | Oracle WebLogic Server suffered an unauthenticated remote code execution vulnerability that was actively exploited in the wild. |
| 2026-08-24 | CVE-2026-21962 | high | Oracle HTTP Server and Weblogic Server Proxy Plug-in suffer from an improper access control flaw allowing unauthorized data manipulation and full data access. |
| 2026-08-18 | CVE-2026-61003 | critical | A critical remote code execution flaw in Oracle Managed File Transfer allows low-privileged attackers to take over the system via network access. |
| 2026-08-18 | CVE-2026-61248 | critical | A critical LDAP server vulnerability in Oracle Internet Directory allows low-privileged attackers to take over the system via network access. |
| 2026-08-18 | CVE-2026-61001 | critical | A critical unpatched vulnerability in Oracle Web Services Manager allows low-privileged attackers to compromise the system and access all data via HTTP. |
| 2026-08-18 | CVE-2026-60990 | critical | A critical remote code execution flaw in Oracle Identity Manager Connector allows low-privileged attackers to take over the system via network access. |
| 2026-08-18 | CVE-2026-61066 | critical | A critical RMI-based vulnerability in Oracle Identity Manager allows low-privileged attackers to take over the system. |
| 2026-08-18 | CVE-2026-70905 | critical | Unauthenticated attackers can take over Oracle Access Manager via SAML-based network access. |
| 2023-02-02 | CVE-2022-21587 | critical | An unauthenticated attacker could compromise Oracle E-Business Suite via an unspecified vulnerability in Oracle Web Applications Desktop Integrator. |
| 2022-05-25 | CVE-2010-0840 | high | An unspecified vulnerability in Oracle's Java Runtime Environment (JRE) was actively exploited in the wild, affecting confidentiality, integrity, and availability. |
| 2022-03-03 | CVE-2015-4902 | high | Oracle Java SE suffered an integrity vulnerability that was actively exploited in the wild, highlighting the severe risks of unpatched legacy software. |
| 2022-03-03 | CVE-2011-3544 | high | Oracle Java SE JRE had an access control flaw in the Rhino Script Engine allowing remote arbitrary code execution. |
| 2022-03-03 | CVE-2015-2590 | high | Oracle Java SE contained an unpatched remote code execution vulnerability that was actively exploited in the wild. |
| 2022-05-25 | CVE-2019-3010 | high | Oracle Solaris XScreenSaver privilege escalation vulnerability was actively exploited in the wild. |
| 2021-11-03 | CVE-2020-14871 | high | An unspecified vulnerability in Oracle Solaris and ZFS was actively exploited in the wild, causing high impacts to confidentiality, integrity, and availability. |
| 2026-07-15 | CVE-2026-46817 | high | Oracle E-Business Suite exposed to unauthenticated attacks via HTTP, potentially allowing takeover of Oracle Payments. |
| 2025-11-21 | CVE-2025-61757 | high | Oracle Fusion Middleware exposed to unauthenticated takeover via Identity Manager |
| 2023-11-16 | CVE-2020-2551 | high | Oracle Fusion Middleware WLS Core Components RCE vulnerability |
| 2023-05-12 | CVE-2016-3427 | high | Oracle Java SE and JRockit unspecified vulnerability allows remote code execution. |
| 2023-05-01 | CVE-2023-21839 | high | Oracle WebLogic Server T3/IIOP RCE vulnerability exploited in the wild |
| 2022-11-28 | CVE-2021-35587 | high | Oracle Fusion Middleware exposed to unauthenticated RCE via HTTP |
| 2022-09-08 | CVE-2018-2628 | high | Oracle WebLogic Server RCE due to unpatched vulnerability |
| 2022-05-25 | CVE-2013-2423 | high | Oracle JRE's hotspot component contained an unspecified vulnerability allowing remote attackers to affect integrity, which was actively exploited in the wild. |
| 2022-03-28 | CVE-2013-2465 | critical | Oracle Java SE vulnerabilities are actively exploited and linked to ransomware attacks, demonstrating a persistent risk for DIB organizations using outdated Java installations. |
| 2022-03-03 | CVE-2012-4681 | critical | Oracle Java SE allowed remote code execution via a known vulnerability actively exploited in ransomware attacks, demonstrating a failure to patch critical systems promptly. |
| 2022-03-03 | CVE-2012-1723 | critical | A critical, actively exploited Java vulnerability allows remote code execution, impacting systems using outdated Java SE Runtime Environments (JRE). |
| 2022-03-03 | CVE-2012-0507 | critical | Oracle Java SE's Concurrency component had a remotely exploitable arbitrary code execution vulnerability, actively targeted by ransomware actors, highlighting the risk of outdated software in DIB environments. |
| 2022-01-18 | CVE-2020-14864 | high | Oracle Business Intelligence Enterprise Edition suffered a path traversal vulnerability allowing attackers to read arbitrary system files via the getPreviewImage function. |
| 2022-01-10 | CVE-2019-2725 | critical | Oracle WebLogic Server's injection vulnerability was actively exploited and linked to ransomware attacks, impacting DIB organizations using this middleware. |
| 2021-11-03 | CVE-2020-14883 | high | Oracle WebLogic Server's Console component contained an unspecified vulnerability that was actively exploited in the wild, impacting confidentiality, integrity, and availability. |
| 2021-11-03 | CVE-2012-3152 | high | Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability allowing remote attackers to compromise confidentiality and integrity. |
| 2021-11-03 | CVE-2015-4852 | high | Oracle WebLogic Server suffered a remote code execution vulnerability via deserialization of untrusted data that was actively exploited in the wild. |
| 2025-02-24 | CVE-2024-20953 | high | Oracle Agile PLM has a deserialization vulnerability actively exploited by attackers to compromise systems via HTTP network access. |
| 2025-01-07 | CVE-2020-2883 | high | Oracle WebLogic Server was exploited in the wild via CVE-2020-2883, an unauthenticated RCE flaw in its IIOP/T3 protocols. |
| 2024-09-18 | CVE-2020-14644 | high | Oracle WebLogic Server suffered a critical unauthenticated remote code execution vulnerability (CVE-2020-14644) actively exploited in the wild. |
| 2022-03-28 | CVE-2012-0518 | high | Oracle Fusion Middleware's Single Sign-On component had an unspecified vulnerability allowing remote attackers to affect integrity. |
| 2022-03-25 | CVE-2019-2616 | high | Oracle BI Publisher had an authentication bypass vulnerability that allowed unauthorized access. |
| 2022-03-03 | CVE-2008-3431 | high | Oracle VirtualBox's VBoxDrv.sys driver had an input validation flaw allowing local arbitrary code execution. |
| 2026-06-01 | CVE-2024-21182 | high | Oracle WebLogic Server vulnerability CVE-2024-21182 allows unauthenticated remote access to critical data via T3/IIOP protocols. |
| 2024-11-21 | CVE-2024-21287 | high | Oracle PLM SDK allows unauthenticated file disclosure via incorrect authorization in Process Extension. |
| 2024-09-18 | CVE-2022-21445 | high | Oracle ADF Faces allows unauthenticated remote code execution via deserialization of untrusted data. |
| 2022-02-18 | CVE-2022-25315 | critical | CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa |
| 2022-02-16 | CVE-2022-25236 | critical | CVE-2022-25236: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names |
| 2022-02-16 | CVE-2022-25235 | critical | CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e |
| 2022-01-24 | CVE-2022-23852 | critical | CVE-2022-23852: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer |
| 2022-01-14 | CVE-2022-23219 | critical | CVE-2022-23219: The deprecated compatibility function clnt_create in the sunrpc module of the GN |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Oracle faced severe fallout from CVE-2012-4681, a critical RCE flaw in its JRE, though the provided sources focus on unrelated 2025 Oracle Cloud breaches and do not directly address the 2012 vulnerabi
synthesissevere-fallout-0.60
Oracle faced severe fallout for a critical RCE vulnerability in its Java Runtime Environment, widely recognized as a major security failure.
synthesissevere-fallout-0.60
Oracle faced severe criticism for a long-standing RCE vulnerability in Java, highlighting systemic security failures in its product lifecycle and delayed patching.
synthesisneutral+0.00
No sentiment expressed; sources are technical databases or lack commentary on Oracle's handling.
synthesissevere-fallout-0.60
Oracle faced severe fallout from a major cloud breach affecting millions of records, though the CVE itself was an unspecified integrity vulnerability; press coverage focused on the breach's scale and
synthesissevere-fallout-0.60
Oracle faced severe fallout for a long-standing, high-impact vulnerability in its core Java runtime, exposing confidentiality, integrity, and availability risks for years before patching.
synthesissevere-fallout-0.60
Oracle faced severe fallout for CVE-2011-3544, a critical RCE flaw in its JRE that remained unpatched for over a decade, allowing remote code execution. The vulnerability was later exploited in a 2025
synthesisneutral+0.00
No sentiment expressed; sources are vulnerability databases and breach trackers with no commentary on Oracle's handling.
synthesissevere-fallout-0.60
Oracle faced severe fallout due to a path traversal vulnerability in Oracle Business Intelligence Enterprise Edition, with CISA confirming active exploitation and data theft impacts on legacy systems,
synthesissevere-fallout-0.60
CISA mandated urgent patching for an actively exploited Oracle WebLogic injection flaw, signaling severe fallout and regulatory pressure.
synthesissevere-fallout-0.60
Oracle faced severe criticism for a critical RCE vulnerability in WebLogic Server, though the provided source is purely factual and lacks sentiment.
synthesissevere-fallout-0.60
Oracle faced severe fallout due to a high-impact unspecified vulnerability in WebLogic Server's Console component, exposing confidentiality, integrity, and availability risks.
synthesissevere-fallout-0.60
Oracle faced severe fallout due to a critical remote code execution vulnerability in WebLogic Server, widely condemned by security researchers and the press for the risk it posed to enterprise environ
synthesissevere-fallout-0.60
Oracle faced severe criticism for a critical RCE vulnerability affecting multiple products, allowing unauthenticated attackers to take over systems.
synthesisneutral-0.20
Unspecified vulnerability reported without severe fallout or praise.
synthesisneutral-0.20
No direct sentiment expressed; sources are technical databases or vendor pages without commentary on Oracle's handling.
synthesissevere-fallout-0.60
Oracle faced severe fallout for CVE-2015-4852, a critical deserialization vulnerability in WebLogic Server allowing remote code execution. The vulnerability was disclosed in 2015 but remained unpatche
synthesissevere-fallout-0.60
Oracle faced severe fallout from CVE-2019-2725, with the vulnerability rated CVSS 9.8 and allowing unauthenticated takeover, though provided sources lack direct press commentary on Oracle's response,
synthesissevere-fallout-0.60
widely condemned
synthesissevere-fallout-0.60
severe-fallout
Neutral; no commentary on vendor handling.
"CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws."
Neutral; source is a CVE database listing unrelated to Oracle's handling.
Neutral; no commentary on vendor handling.
"Look up vulnerabilities across multiple sources"
Neutral; source is a CVE database listing unrelated to Oracle's handling.
Neutral; source is a CVE database listing unrelated to Oracle's handling.
Neutral; technical description only.
"An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code."
Neutral; no commentary on vendor handling.
"GitHub - cisagov/kev-data: Mirror of cisa.gov/kev data files"
Severe condemnation for a critical RCE flaw in Oracle's JRE.
"An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code."
Neutral; source is a CVE database listing unrelated to Oracle's handling.
Neutral; source is a CVE database listing unrelated to Oracle's handling.
FEDRAMP CATALOG PRODUCTS · 10
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| Aconex for Defense | Authorized | Moderate |
| Federal Managed Cloud Services | Authorized | Moderate |
| Fusion Cloud | Authorized | Moderate |
| Government Cloud - Common Controls | Authorized | High |
| Oracle Cloud Infrastructure-Government Cloud | Authorized | High |
| Oracle Enterprise Performance Management (EPM) | Authorized | Low |
| Oracle Enterprise Performance Management (EPM) - Moderate | In Process | Moderate |
| Oracle Service Cloud | Authorized | Moderate |
| Oracle Service Cloud (DOD) | Authorized | Moderate |
| Taleo Cloud - U.S. Government Cloud | Authorized | Moderate |
DOSSIER SOURCES
- Oracle (ORCL) Company Profile & Description - Stock Analysis · stockanalysis.com
- Oracle June 2026 CPU Patches: 270+ Vulnerability Fixes · manageditblog.com
- Prepare Now: Apply the Upcoming Oracle Database Release Update ... · blogs.oracle.com
- Oracle - Investor Relations · investor.oracle.com
Open questions: Oracle's current patch SLA and vulnerability disclosure timeline · Specific remediation steps taken for CVE-2026-35273 and CVE-2025-61884
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-15 04:06:20.341084+00:00