Oracle vulnerabilities (CVEs)

96 CVEs matched to Oracle by name in NVD, none on CISA's Known Exploited list.

Back to the Oracle profile · Alternatives to Oracle · CVE RSS feed

Exploitation riskProbably exploited

95 of 96 CVEs assessed

confirmed exploited

EPSS ≥ 10%

>99%

highest single CVE

2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2003-0727 ↗EPSS 68%LEV ≥>99%Probably exploited
Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user…
CVE-2003-0096 ↗EPSS 16%LEV ≥>99%Probably exploited
Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conve…
CVE-2003-0095 ↗EPSS 13%LEV ≥>99%Probably exploited
Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is …

Recent changes

last 90 days

CVE-2001-0499 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2002-0565 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2000-0987 is now estimated at a 99% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2000-1180 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2001-0832 is now estimated at a 77% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	High	Medium	Low	Unscored	Total
2004	0	1	1	0	2
2003	6	5	1	0	12
2002	20	19	1	0	40
2001	12	12	3	0	27
2000	3	5	0	0	8
1999	1	3	0	1	5
1997	1	1	0	0	2

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2001-0499	85%	>99%
CVE-2002-0568	75%	>99%
CVE-2002-0965	70%	99%
CVE-2003-0727	68%	99%
CVE-2001-1217	54%	99%
CVE-2002-0563	51%	99%
CVE-2000-0169	27%	98%
CVE-2001-0419	24%	98%
CVE-2002-0386	22%	98%
CVE-2002-0569	19%	97%

Known CVEs (96)

RSS ⇢

CVE-2004-1877 ↗LOW 2.62004
The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the log…
CVE-2004-2134 ↗MEDIUM 4.62004
Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.
CVE-2003-1563 ↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Oracle by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.