ACTIVELY EXPLOITED
CVE-2018-2628: Oracle WebLogic Server Unspecified Vulnerability
| Vendor | Oracle |
|---|---|
| Product | WebLogic Server |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Sep 2022 |
| CISA federal deadline | 29 Sep 2022 |
| Weakness (CWE) | CWE-502 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
SOURCES
Other Oracle flaws
- CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
- CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability
- CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.