Critical severity vulnerabilities

23,847 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70984Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70981Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.0 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70980Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentica

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Missing Authentication for Critical Functionality

  CVE-2026-70979Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70978Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Missing Authentication for Critical Functionality

  CVE-2026-70977Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70976Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticate

• 9.8 Critical severity

  Oracle WebCenter Portal: Improper Access Control

  CVE-2026-70970Aug 18, 2026Oracle

  Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 9.6 Critical severity

  Oracle Hyperion Infrastructure Technology: URL Redirection to Untrusted Site

  CVE-2026-70958Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker wit

• 9.8 Critical severity

  Oracle Commerce Platform: Missing Authentication for Critical Functionality

  CVE-2026-70954Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 9.8 Critical severity

  Oracle Commerce Platform: Missing Authentication for Critical Functionality

  CVE-2026-70953Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP t

• 9.8 Critical severity

  Oracle Workflow: Missing Authentication for Critical Functionality

  CVE-2026-70926Aug 18, 2026Oracle

  Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via

• 10.0 Critical severity

  Oracle Hyperion Financial Management: Improper Access Control

  CVE-2026-70921Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to

• 9.9 Critical severity

  Oracle Hyperion Financial Management: Improper Access Control

  CVE-2026-70920Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-70905Aug 18, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.1 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70884Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.1 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70883Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 10.0 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70880Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.1 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70876Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with networ

• 9.8 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70873Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.1 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70872Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.8 Critical severity

  Oracle Hyperion Data Relationship Management: Improper Access Control

  CVE-2026-70871Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with networ

• 9.1 Critical severity

  Oracle Application Testing Suite: Improper Access Control

  CVE-2026-70862Aug 18, 2026Oracle

  Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful atta

• 9.3 Critical severity

  Siebel Apps - Self Service: Improper Access Control

  CVE-2026-70855Aug 18, 2026Oracle

  Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to co

• 9.1 Critical severity

  Oracle Hyperion Financial Management: Improper Access Control

  CVE-2026-70854Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

• 9.6 Critical severity

  Oracle Demand Planning: Improper Access Control

  CVE-2026-70846Aug 18, 2026Oracle

  Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to

• 9.8 Critical severity

  Oracle Hyperion Financial Management: Improper Privilege Management

  CVE-2026-70817Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

• 9.8 Critical severity

  Oracle Hyperion Financial Reporting: Improper Access Control

  CVE-2026-70745Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to c

• 9.1 Critical severity

  Oracle Hyperion Financial Reporting: Improper Access Control

  CVE-2026-70741Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to co

• 9.8 Critical severity

  Oracle Hyperion Financial Reporting: Improper Access Control

  CVE-2026-70740Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to c

• 9.8 Critical severity

  Oracle Hyperion Financial Reporting: Improper Access Control

  CVE-2026-70739Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to c

• 9.1 Critical severity

  Oracle Hyperion Profitability and Cost…: Improper Access Control

  CVE-2026-70730Aug 18, 2026Oracle

  Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network ac

• 9.8 Critical severity

  Oracle Essbase: Improper Access Control

  CVE-2026-70689Aug 18, 2026Oracle

  Vulnerability in Oracle Essbase (component: Infrastructure). The supported version that is affected is 21.8.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of

• 9.3 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-70673Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce

• 9.8 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-70669Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce

• 9.1 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-70668Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce

• 9.0 Critical severity

  froxlor: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-62988Aug 18, 2026Froxlor

  Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.

• 9.8 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-62640Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce

• 9.8 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-62639Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce

• 9.1 Critical severity

  Oracle Reports Developer: Improper Access Control

  CVE-2026-62638Aug 18, 2026Oracle

  Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acce