DaystoPatch

VendorsEnterprise apps, Infrastructure

Oracle

Oracle makes the Oracle Database, Java, the E-Business Suite and Fusion Middleware business software, and the Oracle Cloud Infrastructure platform.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
10 Jun 2026
Incidents on record
10

Response to exploited bugs

79 range 68ā€“90rank 9 of 10

Provisional 4 reviewed zero-days. Not enough yet for a firm grade.

Fixing privately reported bugs

78 range 68ā€“88rank 4 of 20

Provisional Wide range: 68ā€“88.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a Dāˆ’. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: B (79), provisional, from 4 reviewed zero-days in the last 36 months. Likely range 68 to 90.
  • First fix within a day for 1 of 4 zero-days. The other 3 took a median of 6 days, longest 7 days.
  • Every supported version fixed within a day for 1 of 4 zero-days. The other 3 took a median of 6 days, longest 7 days.
  • First advisory within a day for 2 of 4 zero-days. The other 2 took a median of 4 days, longest 7 days.
  • Fixing privately reported bugs: B (78), provisional. Median 64 days from private report to ZDI's public advisory (25 cases). 7 of 25 took longer than ZDI's 120-day deadline. 21 of 25 concern VirtualBox.
  • 5 of 9 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.

Response to exploited bugs: sub-scores

  • Time to first advisory2 of 4 zero-days within a day, longest 7 days
    78B
    4 cases, low confidence, weight 20%
  • Time to first fix1 of 4 zero-days within a day, longest 7 days
    79B
    4 cases, low confidence, weight 40%
  • Time to fix all versions1 of 4 zero-days within a day, longest 7 days
    83B+
    4 cases, low confidence, weight 30%
  • OpennessAdvisories available by RSS. 4 of 4 zero-days with a dated revision history. 4 of 4 fixed zero-days with a public fix date for every version. 2 of 3 zero-days not fixed within a day had an advisory or mitigation within 72 hours.
    70C+
    7 cases, low confidence, weight 10%

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 64 days from private report to ZDI's public advisory (25 cases)
    78B
    25 cases, low confidence, weight 100%

Response fingerprint

Median of 4 graded zero-days. Vendor statement 24h, first fix 4d, all versions 4d.

Compressed time scale

Counts toward the response grade 4

  1. 10 Jun 2026Oracle PeopleSoft PeopleTools zero-day exploited by ShinyHunters (CVE-2026-35273)
  2. 4 Oct 2025Oracle E-Business Suite Configurator SSRF used by the leaked ShinyHunters exploit (CVE-2025-61884)
  3. 2 Oct 2025Oracle E-Business Suite zero-day exploited in Clop data-theft campaign (CVE-2025-61882)
  4. 18 Nov 2024Oracle Agile PLM unauthenticated file disclosure zero-day (CVE-2024-21287)
Not graded 6: n-days, unreviewed timelines and end-of-life products
  1. 28 May 2026Oracle E-Business Suite (Oracle Payments) unauthenticated takeover flawNot graded: n-day
  2. 20 Jan 2026Oracle HTTP Server / WebLogic Server Proxy Plug-in access-control flaw (CVSS 10.0)Not graded: n-day
  3. 21 Oct 2025Oracle Identity Manager pre-authentication remote code execution (October 2025 CPU)Not graded: unclear
  4. 16 Jul 2024Oracle WebLogic Server T3/IIOP unauthenticated data-access flaw (July 2024 CPU)Not graded: n-day
  5. 16 Jan 2024Oracle Agile PLM deserialization flaw (January 2024 CPU)Not graded: n-day
  6. 14 Apr 2020Oracle WebLogic Server T3/IIOP remote code execution (April 2020 CPU)Not graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

10 in 24 months, 3 with known ransomware use, 44% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
10 Jun 2026Oracle PeopleSoft PeopleTools zero-day exploited by ShinyHunters (CVE-2026-35273)CVE-2026-352739.8same day6d6dFixedCounts toward grade
28 May 2026Oracle E-Business Suite (Oracle Payments) unauthenticated takeover flawCVE-2026-468179.8same daysame daysame dayFixedNot graded: n-day
20 Jan 2026Oracle HTTP Server / WebLogic Server Proxy Plug-in access-control flaw (CVSS 10.0)CVE-2026-2196210.0same daysame daysame dayFixedNot graded: n-day
21 Oct 2025Oracle Identity Manager pre-authentication remote code execution (October 2025 CPU)CVE-2025-617579.8same daysame daysame dayFixedNot graded: unclear
4 Oct 2025Oracle E-Business Suite Configurator SSRF used by the leaked ShinyHunters exploit (CVE-2025-61884)CVE-2025-618847.57d7d7dFixedCounts toward grade
2 Oct 2025Oracle E-Business Suite zero-day exploited in Clop data-theft campaign (CVE-2025-61882)CVE-2025-618829.82d2d2dFixedCounts toward grade
18 Nov 2024Oracle Agile PLM unauthenticated file disclosure zero-day (CVE-2024-21287)CVE-2024-212877.5same daysame daysame dayFixedCounts toward grade
16 Jul 2024Oracle WebLogic Server T3/IIOP unauthenticated data-access flaw (July 2024 CPU)CVE-2024-211827.5same daysame daysame dayFixedNot graded: n-day
16 Jan 2024Oracle Agile PLM deserialization flaw (January 2024 CPU)CVE-2024-209538.8same daysame daysame dayFixedNot graded: n-day
14 Apr 2020Oracle WebLogic Server T3/IIOP remote code execution (April 2020 CPU)CVE-2020-28839.8same daysame daysame dayFixedNot graded: n-day

Private reports

Median 64 days, 28% over 120 days, 0 published unpatched

Bugs reported privately to Oracle by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
9 Sep 2026ZDI-26-640, ZDI-26-641CVE-2026-71114, CVE-2026-71132VirtualBox47to publicationYes
9 Sep 2026ZDI-26-639, ZDI-26-643CVE-2026-60162, CVE-2026-71116VirtualBox61to publicationYes
9 Sep 2026ZDI-26-642CVE-2026-60159VirtualBox64to publicationYes
9 Sep 2026ZDI-26-644CVE-2026-60155VirtualBox76to publicationYes
9 Sep 2026ZDI-26-636, ZDI-26-637, ZDI-26-638CVE-2026-60412, CVE-2026-60413, CVE-2026-60414Outside In Technology154to publicationYes
9 Sep 2026ZDI-26-635CVE-2026-60392Outside In Technology162to publicationYes
24 Jun 2026ZDI-26-387, ZDI-26-388, ZDI-26-389CVE-2026-35273PeopleSoft14to publicationYes
24 Jun 2026ZDI-26-362CVE-2026-46873VirtualBox68to publicationYes
28 Apr 2026ZDI-26-306CVE-2026-35230VirtualBox34to publicationYes
13 Feb 2026ZDI-26-100, ZDI-26-101CVE-2026-21963, CVE-2026-21985VirtualBox127to publicationYes
Show all 25 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
13 Feb 2026ZDI-25-958, ZDI-25-959, ZDI-25-960, ZDI-25-961, ZDI-25-962, ZDI-26-097, ZDI-26-098, ZDI-26-099, ZDI-26-102, ZDI-26-103CVE-2025-62588, CVE-2025-62589, CVE-2025-62590, CVE-2025-62591, CVE-2025-62641, CVE-2026-21955, CVE-2026-21956, CVE-2026-21957, CVE-2026-21983, CVE-2026-21984VirtualBox141to publicationYes
27 Oct 2025ZDI-25-957CVE-2025-61759VirtualBox83to publicationYes
29 Jul 2025ZDI-25-692CVE-2024-21273VirtualBox294to publicationYes
15 Jul 2025ZDI-25-602CVE-2025-53027VirtualBox43to publicationYes
15 Jul 2025ZDI-25-598, ZDI-25-599CVE-2025-53025, CVE-2025-53026VirtualBox53to publicationYes
15 Jul 2025ZDI-25-600, ZDI-25-601CVE-2025-53024, CVE-2025-53028VirtualBox55to publicationYes
30 Apr 2025ZDI-24-411, ZDI-24-412, ZDI-24-413, ZDI-24-414, ZDI-24-415, ZDI-24-776, ZDI-25-257CVE-2024-21112, CVE-2024-21113, CVE-2024-21114, CVE-2024-21115, CVE-2024-21121VirtualBox398to publicationYes
17 Oct 2024ZDI-24-1414CVE-2024-21273VirtualBox28to publicationYes
17 Oct 2024ZDI-24-1413CVE-2024-21259VirtualBox79to publicationYes
17 Oct 2024ZDI-24-1412CVE-2024-21248VirtualBox97to publicationYes
30 Jul 2024ZDI-24-1034CVE-2024-21164VirtualBox48to publicationYes
26 Apr 2024ZDI-24-410CVE-2024-21116VirtualBox30to publicationYes
26 Apr 2024ZDI-24-409CVE-2024-21110VirtualBox42to publicationYes
26 Apr 2024ZDI-24-408CVE-2024-21109VirtualBox44to publicationYes
6 Feb 2024ZDI-24-096CVE-2024-20953Product Lifecycle Management123to publicationYes

Advisories changed after publication

0 shown, 0 without a revision note

No changes to severity, exploitation, fixed versions, workarounds or dates. 1 wording-only change is hidden.

Grade history

Response to exploited bugs: score at the end of each month.

Show as a table
MonthScoreGrade
Nov 202579B
Dec 202579B
Jan 202679B
Feb 202678B
Mar 202678B
Apr 202678B
May 202678B
Jun 202680B
Jul 202680B
Aug 202679B
Sep 202679B
Oct 202679B

Channels

Get Oracle's own alerts

What we watch

We don't poll this vendor's channels yet. Incidents come from public sources.

See sources and health for when each was last read.