Oracle corporation weblogic server, 2018 to 2021: 5 records, one defect family
Oracle corporation weblogic server has been reported 5 separate times for the same kind of mistake, Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server., between 2018-07-18 and 2021-01-20. A defect family is our own grouping of the CVE corpus: every record naming one product and one weakness class, collected so a repeat is visible as a repeat. No public source publishes this, and what this page counts is how often this one product has gone wrong in this one way.
What this page is, and what it is not
The records are public. This grouping is not. No source publishes defect families, so we built them: every record in the corpus sorted by the product an authority named and the weakness class carried with it, 21316 families over 105586 records. This one holds every record that names Oracle corporation weblogic server and carries Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server., matched character for character. We show the join because a grouping you cannot check is a grouping you should not cite.
That is 5 filings, between 2018-07-18 and 2021-01-20, landing on the same weakness class in the same product. At this count it is a repeat rather than a pattern, and the roster below is short enough to read in full. This is what we held on 2026-09-20.
A repeat is evidence about where to look. If you are reviewing Oracle corporation weblogic server, the records below say which mistake has already been found more than once, which is the cheapest place a reviewer can start. If you are asking the vendor a question, a count under one weakness class is a better question than any single record is.
What this page cannot tell you is decided by what was joined. A product name and a weakness class settled membership, so those two values are the whole of what the page asserts. Records here may sit in the same line of code or in unrelated parts of the product, and we hold no value that separates those cases. A fixed version named in one record closes that record and says nothing about the others. And nothing here describes anyone's systems, because no value in this family connects a product name to an installation.
The names the authorities used
One spelling, used by every authority that filed one of these records: oracle corporation weblogic server.
Family membership: held values. Joined on the product and weakness class the assigning authorities wrote, with no model involved.
What the records offer
No record in this family publishes a fixed version in held sources.
2 records are listed by CISA with a required action, which carries a federal remediation deadline on its own page.
The earliest was published 2018-07-18 and the latest 2021-01-20. That span is how long this product kept producing this weakness, not how long any one record took to fix.
What this family was researched, not held
One WebLogic sentence, four components, 2018 to 2021
These WebLogic records span 2018 to 2021 and share Oracle's own advisory sentence: easily exploitable, unauthenticated, network access over HTTP, takeover of the server. The code behind that sentence is not one place. CVE-2018-2894 sat in WLS Web Services, CVE-2019-2658 in WLS Core Components, CVE-2020-14882 and CVE-2020-14750 in the Console, and CVE-2021-1994 back in Web Services. The Console pair shows how fast this moved: Rapid7 recorded exploitation of CVE-2020-14882 on 29 October 2020, a public bypass of its patch on 1 November, and Oracle's replacement update as CVE-2020-14750 on 2 November. Rapid7 describes that second update as adding authentication and replacing a blocklist with an allowlist, which is a different repair from the first, and CISA added CVE-2020-14882 to its exploited catalog on 3 November 2021.
An advisory sentence that reads the same across years is not evidence of the same defect, and here the named subcomponents differ. Treat the repeated wording as a reason to check each record against your own version list, not as a reason to assume one update covered the rest.
This note says these records read alike, and in this group the likeness is partly Oracle's standard advisory wording rather than a weakness classification. It does not say they share a vulnerability or an estate, and it does not say one fix closes another, except where the sources themselves tie CVE-2020-14750 to the earlier CVE-2020-14882 patch.
Written from cveawg.mitre.org, cveawg.mitre.org, cveawg.mitre.org, rapid7.com, threatprotect.qualys.com, cisa.gov. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.
What this page does not cover
This is a family of records that read alike. It is not a shared vulnerability, not an inventory, and not a statement that one fix closes the rest. Each record's own state, its own dates and its own receipts are on its own page.
Grouped by shared product and weakness, not by shared vulnerability. Each record's own state is on its own page.
Everything this vendor has, including records outside this family:
5 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.