Loading story…
Oracle released its largest-ever Critical Patch Update, fixing 1,235 unique CVEs with 1,449 patches across 32 product families, including 261 critical patches. Oracle E-Business Suite received the highest volume with 410 patches, while Fusion Middleware received 355; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes 18 critical Fusion Middleware vulnerabilities with CVSS scores up to 10.0, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems.
The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include CVE-2026-62549 in Oracle HRMS (UK) (CVSS 9.6), CVE-2026-62546 and CVE-2026-62534 in Oracle Applications Framework (CVSS 9.1 and takeover risk), and CVE-2026-62547 in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Oracle listed CVE-2026-60369 for Oracle Platform Security for Java in Fusion Middleware, affecting supported versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is described as easily exploitable by a low-privileged attacker over HTTP and can lead to full product takeover, with possible broader cross-product impact due to scope change.
Oracle listed CVE-2026-60371 for Oracle Platform Security for Java in Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw requires a low-privileged attacker with access to the physical communication segment and can lead to takeover of the product, with possible broader cross-product impact due to scope change.
Oracle listed CVE-2026-60367 for Oracle Platform Security for Java in Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The Centralized Thirdparty Jars flaw is described as easily exploitable by an unauthenticated attacker over HTTP and can result in full product takeover.
Oracle received CVE-2026-60455 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The Centralized Thirdparty Jars flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, is exploitable by a low-privileged attacker over HTTP, and can lead to full product takeover.
Oracle received CVE-2026-60373 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, is exploitable by a low-privileged attacker over HTTP, and can lead to full product takeover.
Oracle received CVE-2026-60368 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The Centralized Thirdparty Jars flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, is exploitable by a low-privileged attacker over the network via SOAP, and can lead to full product takeover.
Oracle received CVE-2026-60372 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The Centralized Thirdparty Jars flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, is exploitable by an unauthenticated attacker over HTTP, and can lead to full product takeover.
Oracle received CVE-2026-60439 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The Centralized Thirdparty Jars flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, is exploitable by a low-privileged attacker over HTTP, and can lead to full product takeover.
A new CVE entry, CVE-2026-61246, was added for Oracle Platform Security for Java in Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes it as easily exploitable by a low-privileged attacker over HTTP and says successful exploitation can result in full product takeover.
Oracle received CVE-2026-60366 on July 22, 2026 for Oracle Platform Security for Java in Fusion Middleware. The unauthenticated HTTP flaw in the Centralized Thirdparty Jars component carries a CVSS 10.0 score and can lead to full product takeover with possible broader cross-product impact.
In reporting on the July 2026 Critical Patch Update, Oracle Database Server was identified as receiving urgent fixes, including CVE-2026-61211 in the DBMS_CLOUD package with a CVSS score of 9.9 and CVE-2026-47040 in Connection Manager in Oracle Net Services. The flaws were described as potentially enabling takeover of the RDBMS under certain conditions.
Oracle's July 2026 CPU includes 18 critical vulnerabilities affecting Fusion Middleware components including Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager. The referenced analysis says patches are available and notes several issues are remotely exploitable without authentication.
On the same day as the July 2026 CPU, Oracle published or referenced numerous high-severity CVEs affecting Oracle E-Business Suite products such as HRMS, Workflow, Applications Framework, Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, and Public Sector Payroll. The flaws include remotely exploitable issues that can enable data compromise or full product takeover.
Oracle released its July 2026 Critical Patch Update, addressing 1235 unique CVEs through 1449 patches across 32 product families. The advisory is described as Oracle's largest CPU release, with 261 critical patches and heavy impact on Oracle E-Business Suite and Fusion Middleware.
Several Oracle vulnerability records tied to the July 2026 Critical Patch Update state they were received by Oracle on July 21, 2026, including CVE-2026-62534 and CVE-2026-62513 affecting Oracle E-Business Suite components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
35 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle-related security advisories were issued for multiple enterprise products, including **Oracle Database Server**, **Oracle Fusion Middleware**, **Oracle REST Data Services**, **Oracle Java SE**, **Oracle Financial Services Applications**, and **Oracle E-Business Suite**. Germany's dCERT published separate advisories for each affected product line, indicating broad exposure across core Oracle infrastructure and business application environments. One of the disclosed flaws, **`CVE-2026-34275`**, affects the **Setup and Administration** component of **Oracle Advanced Inbound Telephony** in **Oracle E-Business Suite** versions **12.2.3 through 12.2.15**. Oracle rated the issue **critical** with a **CVSS v3.1 score of 9.8**, stating that an **unauthenticated attacker** with **network access over HTTP** could exploit it to achieve **full takeover** of the affected application. The vulnerability was disclosed as part of Oracle's broader Critical Patch Update, underscoring the need for organizations running Oracle platforms to prioritize patch review and remediation across exposed systems.
Jun 29, 2026
Oracle released its January 2026 *Critical Patch Update (CPU)*, delivering **337 security updates addressing 158 unique CVEs** across roughly 30 product families; **27** of the updates were rated **critical**. Tenable’s analysis highlights broad exposure to remotely exploitable issues without authentication across multiple Oracle product lines, and notes **CVE-2026-21945**, a high-severity **SSRF** issue in Oracle Java, was discovered by Tenable Research. A standout issue in the CPU is **CVE-2026-21962** (CVSS **10.0**), an **easily exploitable, unauthenticated, network-reachable (HTTP)** vulnerability in Oracle Fusion Middleware components **Oracle HTTP Server** and the **WebLogic Server Proxy Plug-ins** (Apache and IIS). Successful exploitation can enable **unauthorized creation, deletion, or modification of critical data** and potentially broader downstream impact due to a **scope change** (`S:C`), meaning compromise may significantly affect additional products; affected versions include **12.2.1.4.0**, **14.1.1.0.0**, and **14.1.2.0.0** (with the IIS proxy plug-in affected in **12.2.1.4.0** only).
Jun 29, 2026
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions `12.2.3` through `12.2.15`, including **CVE-2026-46817** in the Oracle Payments File Transmission component and **CVE-2026-46933** in Oracle Applications Manager. **CVE-2026-46817**, rated `CVSS 9.8`, can be exploited by an unauthenticated remote attacker over HTTP via the `/OA_HTML/ibytransmit` endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while **CVE-2026-46933**, rated `CVSS 9.9`, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities. Security researchers reported that **CVE-2026-46817** is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read `/etc/passwd`, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Jul 17, 2026