NCSC-2026-0306 [1.00] [H/H] Vulnerabilities resolved in Oracle Fusion Middleware
Oracle has resolved 262 vulnerabilities in diverse Oracle products, including Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, and Oracle Identity Manager Connector. The vulnerabilities involve different security issues in Oracle products, including possibilities for unauthenticated and low-privileged attackers to perform unauthorized actions via network access (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP). These actions include gaining complete system control, executing arbitrary code, creating, modifying or deleting critical data, bypassing authentication controls, obtaining unauthorized access to sensitive information, and causing Denial-of-Service (DoS) through crashes or resource exhaustion. Some vulnerabilities require user interaction, while others can be completely exploited remotely and without authentication. The CVSS 3.1 base scores range from moderate to maximum (up to 10.0), with multiple vulnerabilities scoring 9.8 or higher, indicating a high potential for impact on confidentiality, integrity and availability of the systems. 182 of these vulnerabilities can be exploited remotely without prior authentication. The vulnerabilities are specific to certain versions of the mentioned Oracle products but may also affect other Oracle products that depend on these components. The NCSC advises resolving these vulnerabilities with priority.
CSIRTS triage
- What
- 262 vulnerabilities across Oracle Fusion Middleware products enable unauthenticated and low-privileged attackers to execute arbitrary code, gain complete system control, and modify data via network protocols.
- Who is affected
- Users of Oracle WebLogic Server, Identity Manager, WebCenter Portal/Content/Sites, Reports, Helidon, Access Manager, Unified Directory, Virtual Directory, Internet Directory, Web Services Manager, SOA Suite, MFT, and Identity Connector.
- Urgency
- Critical; massive vulnerability set with unauthenticated RCE capabilities affecting multiple critical middleware products.
- Action
- Apply Oracle's security patches for Fusion Middleware products immediately; obtain complete CVE list and version-specific fixes from Oracle Security Alert.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0306
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-331861.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425870.99% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-603920.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604120.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604130.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604140.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-604150.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606720.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606790.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-606800.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
- high[UPDATE] [high] Red Hat OpenShift Container Platform (gRPC-Go): Vulnerability allows bypassing security measur…cert-bund
- unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
- high[NEW] [HIGH] Oracle Communications: Multiple Vulnerabilitiescert-bund
- high[NEW] [high] Oracle Fusion Middleware: Multiple vulnerabilitiescert-bund
- unknownexploitedMultiple vulnerabilities in Oracle Weblogic (August 19, 2026)cert-fr-avis
- criticalCVE-2026-60970: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (…nvd
- highCVE-2026-60969: Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: …nvd
- highCVE-2026-60961: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: …nvd
- criticalCVE-2026-60958: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (…nvd
- highCVE-2026-60955: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: …nvd
- highCVE-2026-60954: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: …nvd
More from NCSC-NL Advisories
- unknownNCSC-2026-0316 [1.00] [M/H] Vulnerabilities resolved in Oracle PeopleSoft Enterprise2026-08-19
- unknownNCSC-2026-0315 [1.00] [M/H] Vulnerabilities resolved in Oracle MySQL2026-08-19
- unknownNCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SE2026-08-19
- unknownNCSC-2026-0313 [1.00] [M/H] Vulnerabilities resolved in Oracle Business Intelligence Enterprise Edition and Or…2026-08-19
- unknownNCSC-2026-0312 [1.00] [M/H] Vulnerabilities resolved in Oracle Financial Services2026-08-19