# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics](https://agentprime.io/advisories/CVE-2026-83261.md)
  `CVE-2026-83261` · CVE record: Oracle Corporation Oracle Product Lifecycle Analytics · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle Agile PLM](https://agentprime.io/advisories/CVE-2026-83260.md)
  `CVE-2026-83260` · CVE record: Oracle Corporation Oracle Agile PLM · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Missing authentication in Oracle Corporation Oracle Data Integrator](https://agentprime.io/advisories/CVE-2026-83232.md)
  `CVE-2026-83232` · CVE record: Oracle Corporation Oracle Data Integrator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83229.md)
  `CVE-2026-83229` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83202.md)
  `CVE-2026-83202` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83201.md)
  `CVE-2026-83201` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel Apps - Financial Services](https://agentprime.io/advisories/CVE-2026-83197.md)
  `CVE-2026-83197` · CVE record: Oracle Corporation Siebel Apps - Financial Services · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-83196.md)
  `CVE-2026-83196` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Missing authentication in Oracle Corporation Siebel CRM End User](https://agentprime.io/advisories/CVE-2026-83154.md)
  `CVE-2026-83154` · CVE record: Oracle Corporation Siebel CRM End User · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Service Delivery Platform](https://agentprime.io/advisories/CVE-2026-83151.md)
  `CVE-2026-83151` · CVE record: Oracle Corporation Service Delivery Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Application Testing Suite](https://agentprime.io/advisories/CVE-2026-83149.md)
  `CVE-2026-83149` · CVE record: Oracle Corporation Oracle Application Testing Suite · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83108.md)
  `CVE-2026-83108` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83107.md)
  `CVE-2026-83107` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83105.md)
  `CVE-2026-83105` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83104.md)
  `CVE-2026-83104` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83103.md)
  `CVE-2026-83103` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83100.md)
  `CVE-2026-83100` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83099.md)
  `CVE-2026-83099` · CVE record: Oracle Corporation Oracle Forms · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83098.md)
  `CVE-2026-83098` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83095.md)
  `CVE-2026-83095` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Forms](https://agentprime.io/advisories/CVE-2026-83094.md)
  `CVE-2026-83094` · CVE record: Oracle Corporation Oracle Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83066.md)
  `CVE-2026-83066` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-83064.md)
  `CVE-2026-83064` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83062.md)
  `CVE-2026-83062` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83061.md)
  `CVE-2026-83061` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83060.md)
  `CVE-2026-83060` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83059.md)
  `CVE-2026-83059` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83058.md)
  `CVE-2026-83058` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83057.md)
  `CVE-2026-83057` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83056.md)
  `CVE-2026-83056` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83055.md)
  `CVE-2026-83055` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Internet Directory](https://agentprime.io/advisories/CVE-2026-83054.md)
  `CVE-2026-83054` · CVE record: Oracle Corporation Oracle Internet Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-83043.md)
  `CVE-2026-83043` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Identity Manager](https://agentprime.io/advisories/CVE-2026-83042.md)
  `CVE-2026-83042` · CVE record: Oracle Corporation Oracle Identity Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-83040.md)
  `CVE-2026-83040` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-83039.md)
  `CVE-2026-83039` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-83038.md)
  `CVE-2026-83038` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-83037.md)
  `CVE-2026-83037` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-83036.md)
  `CVE-2026-83036` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-83035.md)
  `CVE-2026-83035` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-83031.md)
  `CVE-2026-83031` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Managed File Transfer](https://agentprime.io/advisories/CVE-2026-83029.md)
  `CVE-2026-83029` · CVE record: Oracle Corporation Oracle Managed File Transfer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Identity Manager Connector](https://agentprime.io/advisories/CVE-2026-83027.md)
  `CVE-2026-83027` · CVE record: Oracle Corporation Oracle Identity Manager Connector · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-83021.md)
  `CVE-2026-83021` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-83020.md)
  `CVE-2026-83020` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Enterprise Capture](https://agentprime.io/advisories/CVE-2026-83006.md)
  `CVE-2026-83006` · CVE record: Oracle Corporation Oracle WebCenter Enterprise Capture · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Access Manager](https://agentprime.io/advisories/CVE-2026-83001.md)
  `CVE-2026-83001` · CVE record: Oracle Corporation Oracle Access Manager · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Service Delivery Platform](https://agentprime.io/advisories/CVE-2026-83000.md)
  `CVE-2026-83000` · CVE record: Oracle Corporation Service Delivery Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Service Delivery Platform](https://agentprime.io/advisories/CVE-2026-82999.md)
  `CVE-2026-82999` · CVE record: Oracle Corporation Service Delivery Platform · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Service Delivery Platform](https://agentprime.io/advisories/CVE-2026-82998.md)
  `CVE-2026-82998` · CVE record: Oracle Corporation Service Delivery Platform · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Service Delivery Platform](https://agentprime.io/advisories/CVE-2026-82997.md)
  `CVE-2026-82997` · CVE record: Oracle Corporation Service Delivery Platform · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-82995.md)
  `CVE-2026-82995` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-82994.md)
  `CVE-2026-82994` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-73963.md)
  `CVE-2026-73963` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Access Manager](https://agentprime.io/advisories/CVE-2026-73962.md)
  `CVE-2026-73962` · CVE record: Oracle Corporation Oracle Access Manager · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle JDeveloper](https://agentprime.io/advisories/CVE-2026-73961.md)
  `CVE-2026-73961` · CVE record: Oracle Corporation Oracle JDeveloper · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-73957.md)
  `CVE-2026-73957` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-73956.md)
  `CVE-2026-73956` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-73953.md)
  `CVE-2026-73953` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-73952.md)
  `CVE-2026-73952` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTE1VDIwOjAyOjQyLjkxNzAwMFoiLCJDVkUtMjAyNi03Mzk1MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE1VDIwOjA0OjQwLjkzODAwMFoiLCJDVkUtMjAyNi04MzI2OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE1VDIwOjA0OjQwLjkzODAwMFoiLCJDVkUtMjAyNi04MzI2OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.