IONIX THREAT CENTER

CVE-2026-62618 is an authentication bypass vulnerability in Oracle Reports Developer, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the Security and Authentication component, gaining unauthorized access to critical data and the ability to make limited unauthorized modifications. Oracle rates the vulnerability CRITICAL with a CVSS v3.1 base score of 9.3.

CVE-2026-70872 is a critical, unauthenticated vulnerability in the "Access and security" component of Oracle Hyperion Data Relationship Management (DRM). An attacker with only network access to the affected HTTP interface — no credentials or user interaction required — can exploit the flaw to read, create, delete, or modify critical data within the application. Oracle rates the issue 9.1 (Critical) on the CVSS v3.1 scale and disclosed it as part of its August 2026 Critical Security Patch Update.

CVE-2026-70862 is a critical, remotely exploitable vulnerability in Oracle Application Testing Suite that allows a completely unauthenticated network attacker to compromise the confidentiality and integrity of the application. The flaw is exploitable over HTTP without any user interaction, and successful exploitation grants unauthorized creation, deletion, or modification of critical data, as well as read access to all data accessible to Oracle Application Testing Suite. Oracle disclosed the issue as part of its August 2026 Critical Security Patch Update, rating it 9.1 (Critical).

CVE-2026-61018 is a critical, unauthenticated remote compromise vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an attacker with mere network access over HTTP — no credentials and no user interaction — to fully take over an affected WebCenter Sites instance. Oracle rates the issue 9.8 (Critical) on the CVSS v3.1 scale, its second-highest possible severity tier, reflecting complete loss of confidentiality, integrity, and availability.

CVE-2026-62541 is a critical vulnerability in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology, version 11.2.25.0.000. It allows an unauthenticated, remote attacker to compromise the affected system completely, receiving a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-60946 is a critical, unauthenticated remote code execution vulnerability in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. The flaw is remotely exploitable over the network via the RMI protocol without requiring any credentials or user interaction, and successful exploitation can result in a complete compromise of the affected system's confidentiality, integrity, and availability. Oracle disclosed the issue in its August 2026 Critical Patch Update and rated it 9.8 (Critical) on the CVSS v3.1 scale.

CVE-2026-70880 is a critical, easily exploitable vulnerability in the Access and security component of Oracle Hyperion Data Relationship Management (DRM) that allows a completely unauthenticated, remote attacker with network access via TCP to fully compromise the affected system. Oracle disclosed the flaw in its August 2026 Critical Security Patch Update, and it carries the maximum CVSS v3.1 base score of 10.0 due to the combination of no authentication requirement, no user interaction, a changed scope, and complete loss of confidentiality, integrity, and availability.

CVE-2026-62621 is a critical vulnerability in the Security and Authentication component of Oracle Reports Developer, part of Oracle Fusion Middleware. It allows an unauthenticated, remote attacker with network access to fully compromise the affected application, with high impact to confidentiality, integrity, and availability. Oracle disclosed the flaw in its August 2026 Critical Security Patch Update with a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-62544 is a critical vulnerability in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology, affecting version 11.2.25.0.000. The flaw allows an unauthenticated, remote attacker with network access via HTTP to fully compromise the affected system, impacting confidentiality, integrity, and availability. Oracle rates this vulnerability as easily exploitable and disclosed it as part of its August 2026 Critical Patch Update.

CVE-2026-62626 is a critical, unauthenticated remote code execution vulnerability in Oracle Reports Developer, a component of Oracle Fusion Middleware. It resides in the product's Security and Authentication component and allows a network attacker to fully compromise the affected system without credentials or user interaction. Oracle rates this vulnerability CRITICAL with a CVSS v3.1 base score of 9.8.

CVE-2026-62610 is a critical vulnerability in the Security and Authentication component of Oracle Reports Developer, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible to Oracle Reports Developer. Oracle rates this as easily exploitable with a CVSS 3.1 base score of 9.1 (Critical).

CVE-2026-62611 is a critical vulnerability in Oracle Reports Developer, a component of Oracle Fusion Middleware. It resides in the Security and Authentication component and allows an unauthenticated, network-based attacker to compromise the product via the IIOP protocol, resulting in a complete takeover of the affected system. Oracle rates this as CVSS 9.8 (Critical) in its August 2026 Critical Patch Update.

CVE-2026-62614 is a critical vulnerability in the Security and Authentication component of Oracle Reports Developer (part of Oracle Fusion Middleware). It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer, with Oracle's advisory noting successful exploitation can result in complete takeover of the product. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-62539 is a critical, easily exploitable vulnerability in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology. It allows an unauthenticated attacker with network access via HTTP to fully compromise the affected system, with Oracle stating that successful exploitation "can result in takeover" of Hyperion Infrastructure Technology. The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and was disclosed as part of Oracle's August 2026 Critical Patch Update.

CVE-2026-62634 is a critical vulnerability in the Security and Authentication component of Oracle Reports Developer, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via CORBA to fully compromise the affected system, and Oracle rates it as easily exploitable. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-60977 is a critical vulnerability in Oracle WebLogic Server's WLS Core Components that allows an unauthenticated attacker with network access via RMI to fully compromise the server. Oracle rates it CVSS 9.8 (Critical) and describes it as an easily exploitable flaw with no authentication or user interaction required. It was disclosed as part of Oracle's August 2026 Critical Security Patch Update.

CVE-2026-62543 is a critical vulnerability in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology (part of Oracle Hyperion). It allows an unauthenticated, remote attacker with network access via HTTP to fully compromise and take over the affected system. Oracle rates it 9.8 (Critical) under CVSS v3.1.

CVE-2026-60754 is a critical vulnerability in the Marketing component of Oracle Siebel CRM (Siebel Apps – Marketing) that allows a remote, unauthenticated attacker to compromise the application over HTTP. Successful exploitation results in unauthorized access to critical data and denial-of-service conditions, with no authentication or user interaction required. Oracle assigned this issue a CVSS v3.1 base score of 9.1 (Critical) and disclosed it in the August 2026 Critical Patch Update.

CVE-2026-60591 is a critical, easily exploitable vulnerability in the POS component of Oracle Hospitality Simphony. It allows an unauthenticated attacker with network access via HTTP to compromise the system, enabling unauthorized creation, deletion, or modification of critical data as well as denial-of-service conditions. Oracle disclosed the flaw in its August 2026 Critical Security Patch Update with a CVSS v3.1 base score of 9.1 (Critical).