CWE-306

High likelihood

Missing Authentication for Critical Function

Parent: CWE-287 - Improper Authentication

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

2,844 vulnerabilities with CWE-306
CVE-2026-60855 HIGH
Oracle Quality 12.2.3-12.2.15 - Authenticated Remote Takeover via HTTP
CVSS 7.5
CVE-2026-60810 HIGH
Oracle Supply Chain Trading Connector 12.2.3-12.2.15 - Unauthenticated Data Access and Modification via HTTP
CVSS 8.2
CVE-2026-60712 MEDIUM
Siebel CRM Cloud Applications 22.3-26.5 - Authenticated Unauthorized Critical Data Access via Siebel Cloud Manager
CVSS 6.5
CVE-2026-60711 CRITICAL
Siebel CRM Cloud Applications 22.3-26.5 - Authenticated Remote Code Execution via Siebel Cloud Manager
CVSS 9.9
CVE-2026-60705 HIGH
Oracle Corporation Siebel Crm Cloud Applications < 26.5 - Denial of Service
CVSS 7.0
CVE-2026-60704 HIGH
Siebel CRM Cloud Applications 22.3-26.5 - Unauthenticated Unauthorized Data Access via HTTP
CVSS 7.5
CVE-2026-60689 HIGH
Siebel CRM Cloud Applications 22.3-26.5 - Unauthenticated Unauthorized Data Access via HTTP
CVSS 7.5
CVE-2026-60678 HIGH
Oracle General Ledger 12.2.3-12.2.15 - Authenticated Remote Code Execution via SOAP
CVSS 8.8
CVE-2026-60674 HIGH
Oracle BIEE 8.2.0.0.0/26.01.0.0.0 Unauthenticated Data Access/Modification via HTTP
CVSS 8.2
CVE-2026-60671 HIGH
Oracle Business Intelligence Enterprise Edition - Denial of Service
CVSS 8.6
CVE-2026-60670 HIGH
Oracle Applications Technology Stack 12.2.3-12.2.15 - Unauthenticated Remote Code Execution via Client System Analyzer
CVSS 8.1
CVE-2026-60654 HIGH
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 - Authenticated Remote Code Execution via Web Content Management
CVSS 8.8
CVE-2026-60653 HIGH
Oracle WebCenter Content 12.2.1.4.0/14.1.2.0.0 Authenticated Data Manipulation & Unauthorized Access via WCM
CVSS 8.1
CVE-2026-60652 HIGH
Oracle WebCenter Content 12.2.1.4.0, 14.1.2.0.0 - Remote Code Execution via Web Content Management
CVSS 8.0
CVE-2026-60644 CRITICAL
Oracle WebCenter Content 12.2.1.4.0, 14.1.2.0.0 - Unauthenticated Remote Code Execution via HTTP
CVSS 10.0
CVE-2026-60627 CRITICAL
JD Edwards EnterpriseOne Tools 9.2.26.3 - Authenticated Remote Code Execution via Installation Security Component
CVSS 9.9
CVE-2026-60623 HIGH
Oracle Corporation MySQL Connectors < 9.7.1 - Denial of Service
CVSS 7.1
CVE-2026-60621 HIGH
JD Edwards EnterpriseOne Tools 9.2.26.3 - Unauthenticated Remote Code Execution via Web Runtime Security
CVSS 8.1
CVE-2026-60619 HIGH
JD Edwards EnterpriseOne HCM 9.2 Authenticated RCE via Time Accounting & HRM Base Component
CVSS 7.5
CVE-2026-60618 HIGH
JD Edwards EnterpriseOne Procurement and Subcontract Management 9.2 - Authenticated Remote Code Execution via HTTP
CVSS 8.8
CVE-2026-60616 MEDIUM
PeopleSoft Enterprise CS Campus Community 9.2.38 - Unauthenticated Data Access and Modification via HTTP
CVSS 6.5
CVE-2026-60605 HIGH
PeopleSoft Enterprise CS Student Records 9.2.38 - Unauthenticated Unauthorized Data Access via HTTP
CVSS 7.5
CVE-2026-60604 HIGH
PeopleSoft Enterprise CS Campus Community 9.2.38 - Authenticated Remote Takeover via HTTP
CVSS 7.5
CVE-2026-60602 HIGH
PeopleSoft Enterprise CS Student Financials 9.2.38 - Authenticated Remote Code Execution via Billing Component
CVSS 8.8
CVE-2026-60600 HIGH
PeopleSoft Enterprise FIN Project Costing 9.2 - Unauthenticated Remote Code Execution via Local Infrastructure Access
CVSS 7.8
Details
Vulnerabilities 2,844
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits