IONIX THREAT CENTER

CVE-2026-83261 is a critical, unauthenticated remote compromise vulnerability affecting Oracle Product Lifecycle Analytics (part of the Oracle Supply Chain product family), specifically the Core component. The flaw allows a network-based attacker to fully compromise the application over HTTP without any credentials or user interaction, and Oracle rates it 9.8 (Critical) on the CVSS v3.1 scale.

CVE-2026-83462 is a critical vulnerability in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite). The flaw allows an unauthenticated, remote attacker with network access via TCP to fully compromise the affected server. Oracle rates this issue CRITICAL with a CVSS v3.1 base score of 9.8.

CVE-2026-83452 is a critical vulnerability in the Internal Operations component of Oracle Document Management and Collaboration, a module of Oracle E-Business Suite. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application, with the potential for complete system takeover. Oracle rates this vulnerability CRITICAL with a CVSS v3.1 base score of 9.8.

CVE-2026-83104 is a critical missing-authentication vulnerability affecting the Forms Services, C/S, and Charmode components of Oracle Forms (part of Oracle Fusion Middleware). The flaw allows an unauthenticated, remote attacker with network access via TCP to compromise Oracle Forms without any user interaction. Oracle rates the vulnerability CRITICAL with a CVSS 3.1 base score of 9.1.

CVE-2026-83021 is a critical, unauthenticated remote code execution vulnerability in the Web Container component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw is remotely exploitable over HTTP without any authentication or user interaction, and a successful attack results in complete takeover of the WebLogic Server. It carries the maximum CVSS v3.1 base score of 10.0.

CVE-2026-83100 is a critical vulnerability in the Oracle Forms product of Oracle Fusion Middleware, stemming from missing/improper authentication for a critical function (CWE-306, CWE-287). It allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Forms. Oracle rates this as CVSS 9.8 (Critical), and it is described as "easily exploitable."

CVE-2026-83095 is a critical vulnerability in Oracle Forms caused by missing authentication for a critical function. It allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Forms, resulting in complete takeover of the affected system. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-73944 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, with high impact to confidentiality and integrity. It carries a CVSS v3.1 base score of 9.1 (Critical) and was disclosed via an Oracle Critical Security Patch Update advisory on September 15, 2026.

CVE-2026-73940 is a critical, easily exploitable vulnerability in the Authentication Engine component of Oracle Access Manager (part of Oracle Fusion Middleware). It allows an unauthenticated, network-based attacker with access via the T3 or IIOP protocols to compromise Oracle Access Manager and potentially achieve complete takeover of the product. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-73963 is a critical, remotely exploitable vulnerability in the Portlet Services component of Oracle WebCenter Portal (part of Oracle Fusion Middleware). It allows an unauthenticated attacker with network access via HTTP to fully compromise the application, with successful exploitation resulting in complete takeover of the affected WebCenter Portal instance. Oracle rates this vulnerability as easily exploitable and disclosed it in the September 2026 Critical Security Patch Update (CSPU).

CVE-2026-83202 is a critical vulnerability in the Server Infrastructure component of Oracle Siebel CRM Deployment. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. Oracle rates the flaw 9.1 (Critical) and describes it as easily exploitable.

CVE-2026-73952 is a critical vulnerability in the Portlet Services component of Oracle WebCenter Portal (part of Oracle Fusion Middleware). It allows an unauthenticated, network-based attacker to compromise the application over HTTP, resulting in unauthorized creation, deletion, or modification of critical data as well as full read access to all data accessible to WebCenter Portal. Oracle rates the flaw as "easily exploitable" with a CVSS 3.1 base score of 9.1 (Critical).

CVE-2026-87129 is a critical vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management (DRM), affecting version 11.2.26.0.000. The flaw allows an unauthenticated, remote attacker with network access via HTTP to create, delete, or modify critical data and to view confidential information without any prior authentication. Oracle rates this as easily exploitable, and it carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-83094 is a critical missing/improper authentication vulnerability (CWE-306, CWE-287) in the Forms Services, C/S, Charmode component of Oracle Forms (part of Oracle Fusion Middleware). It allows an unauthenticated attacker with network access via HTTP to compromise and fully take over Oracle Forms. Oracle rates it CRITICAL with a CVSS 3.1 base score of 9.8, and it was disclosed in the September 2026 Critical Patch Update.

CVE-2026-87128 is a critical, easily exploitable vulnerability in the "Access and security" component of Oracle Hyperion Data Relationship Management (DRM). It allows an unauthenticated attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data as well as full unauthorized read access to all accessible data. The flaw was disclosed by Oracle as part of the September 2026 Critical Security Patch Update and carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-83355 is a critical vulnerability in the Metrics component of Oracle Enterprise Manager for Fusion Middleware that allows a remote, unauthenticated attacker to fully compromise the affected system over HTTP. Oracle rates the flaw as easily exploitable, and it carries a CVSS v3.1 base score of 9.8 (Critical). Successful exploitation results in complete loss of confidentiality, integrity, and availability of the Enterprise Manager deployment.

CVE-2026-71133 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to fully compromise the product, and Oracle notes the attack may significantly impact additional products due to a scope change. The flaw carries the maximum CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-83035 is a critical, unauthenticated remote takeover vulnerability affecting Oracle WebCenter Sites, part of Oracle Fusion Middleware. The flaw is remotely exploitable over HTTP without any authentication or user interaction, and successful exploitation can result in a complete compromise ("takeover") of the affected Oracle WebCenter Sites instance. Oracle rates this vulnerability as CRITICAL with a CVSS v3.1 base score of 9.8.