Critical Vulnerabilities in Oracle Products Exposed

Two critical vulnerabilities, CVE-2026-61295 and CVE-2026-70948, were published on August 18, 2026, affecting Oracle's WebCenter Content and Purchasing products, respectively. CVE-2026-61295 allows unauthenticated attackers to compromise Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0, with a CVSS score of 7.1. In contrast, CVE-2026-70948 affects Oracle Purchasing versions 12.2.3 to 12.2.15, enabling low-privileged attackers to take over the system, scoring 8.8 on the CVSS scale. Both vulnerabilities are easily exploitable, with the potential for unauthorized access to sensitive data. The impact of CVE-2026-70948 is particularly severe, affecting confidentiality, integrity, and availability. Organizations using these Oracle products are advised to take immediate action to mitigate risks. The vulnerabilities were first reported by the National Vulnerability Database (NVD).

Key Points: • CVE-2026-61295 affects Oracle WebCenter Content, allowing unauthorized access. • CVE-2026-70948 impacts Oracle Purchasing, enabling system takeover by low-privileged attackers. • Both vulnerabilities were published on August 18, 2026, and require immediate attention.