NCSC-2026-0306 [1.00] [H/H] Vulnerabilities resolved in Oracle Fusion Middleware
Oracle has resolved 262 vulnerabilities in diverse Oracle products, including Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, and Oracle Identity Manager Connector. The vulnerabilities involve different security issues in Oracle products, including possibilities for unauthenticated and low-privileged attackers to perform unauthorized actions via network access (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP). These actions include gaining complete system control, executing arbitrary code, creating, modifying or deleting critical data, bypassing authentication controls, obtaining unauthorized access to sensitive information, and causing Denial-of-Service (DoS) through crashes or resource exhaustion. Some vulnerabilities require user interaction, while others can be completely exploited remotely and without authentication. The CVSS 3.1 base scores range from moderate to maximum (up to 10.0), with multiple vulnerabilities scoring 9.8 or higher, indicating a high potential for impact on confidentiality, integrity and availability of the systems. 182 of these vulnerabilities can be exploited remotely without prior authentication. The vulnerabilities are specific to certain versions of the mentioned Oracle products but may also affect other Oracle products that depend on these components. The NCSC advises resolving these vulnerabilities with priority.
CSIRTS triage
- What
- 262 vulnerabilities across Oracle Fusion Middleware products enable unauthenticated and low-privileged attackers to execute arbitrary code, gain complete system control, and modify data via network protocols.
- Who is affected
- Users of Oracle WebLogic Server, Identity Manager, WebCenter Portal/Content/Sites, Reports, Helidon, Access Manager, Unified Directory, Virtual Directory, Internet Directory, Web Services Manager, SOA Suite, MFT, and Identity Connector.
- Urgency
- Critical; massive vulnerability set with unauthenticated RCE capabilities affecting multiple critical middleware products.
- Action
- Apply Oracle's security patches for Fusion Middleware products immediately; obtain complete CVE list and version-specific fixes from Oracle Security Alert.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0306
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-331861.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425870.99% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603920.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604120.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604130.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604140.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604150.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606720.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606790.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606800.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] Red Hat OpenShift Container Platform (gRPC-Go): Vulnerability allows bypassing security measur…cert-bund
- highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
- high[NEW] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: Mul…cert-bund
- high[NEW] [high] Oracle Siebel CRM: Multiple vulnerabilitiescert-bund
- highexploited[UPDATE] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: …cert-bund
- high[NEW] [high] IBM Concert: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian productsncsc-nl
- unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
- unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
- high[NEW] [HIGH] Oracle Communications: Multiple Vulnerabilitiescert-bund
- high[NEW] [high] Oracle Fusion Middleware: Multiple vulnerabilitiescert-bund
- unknownexploitedMultiple vulnerabilities in Oracle Weblogic (August 19, 2026)cert-fr-avis
More from NCSC-NL Advisories
- unknownNCSC-2026-0340 [1.00] [M/H] Vulnerabilities fixed in Aruba Networks ArubaOS-CX2026-09-03
- unknownNCSC-2026-0339 [1.00] [M/H] Vulnerabilities fixed in HPE Networking Fabric Composer2026-09-03
- unknownNCSC-2026-0338 [1.00] [M/H] Vulnerabilities fixed in Cisco Nexus 9000 Series, IOS XR Software and Secure Email2026-09-03
- unknownNCSC-2026-0337 [1.00] [H/H] Zero-Day vulnerabilities patched in SonicWall SMA1000 Appliance2026-09-02
- unknownNCSC-2026-0336 [1.00] [M/H] Vulnerability patched in JFrog Artifactory2026-09-02