Oracle Critical Patch Update Addresses Multiple High-Risk Enterprise Product Flaws

Oracle released its largest-ever Critical Patch Update, fixing **1,235 unique CVEs** with **1,449 patches** across **32 product families**, including **261 critical patches**. Oracle E-Business Suite received the highest volume with **410 patches**, while Fusion Middleware received **355**; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes **18 critical Fusion Middleware vulnerabilities** with CVSS scores up to **10.0**, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems. The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include `CVE-2026-62549` in Oracle HRMS (UK) (**CVSS 9.6**), `CVE-2026-62546` and `CVE-2026-62534` in Oracle Applications Framework (**CVSS 9.1** and takeover risk), and `CVE-2026-62547` in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.

Jul 23, 2026

Oracle Issues Massive Patch Update for 925 CVEs Across Enterprise Products

Oracle released a **Critical Security Patch Update** containing **943 patches** for **925 unique CVEs** across **23 product families**, making it one of the company’s largest recent security releases. The update includes **154 critical patches** covering **151 CVEs**, with Oracle Fusion Middleware and Oracle Hyperion each receiving **262 patches** and Oracle E-Business Suite receiving **120**. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws. The most severe issues affect major enterprise platforms including **Oracle Internet Directory**, **Hyperion Data Relationship Management**, **Hyperion Financial Management**, and **Oracle WebLogic Server**, with some vulnerabilities rated up to **CVSS 10.0**. Additional critical flaws were reported in **Oracle Identity Manager**, **Siebel CRM Cloud**, **Helidon**, **BI Publisher**, **WebCenter**, **Oracle Payments**, and **PeopleSoft PeopleTools**. Several of the vulnerabilities are described as **unauthenticated network-exploitable** and capable of leading to **remote code execution** or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.

Aug 25, 2026

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Oracle disclosed three high-severity vulnerabilities affecting core enterprise products in its Critical Patch Update advisory. **CVE-2026-34279** impacts the Event Management component of Oracle Enterprise Manager Base Platform versions `13.5` and `24.1` and is rated `CVSS 9.1`; Oracle said a high-privileged attacker with network access over HTTP could exploit the flaw to take over the platform, with potential impact extending to additional products because of a scope change. **CVE-2026-34286**, also rated `CVSS 9.1`, affects the Core component of Oracle Identity Manager Connector in Oracle Fusion Middleware version `12.2.1.4.0` and can be exploited by an unauthenticated attacker over HTTPS. Oracle also reported **CVE-2026-34309** in the Security component of PeopleSoft Enterprise PeopleTools versions `8.61` through `8.62`, assigning it a `CVSS 8.1` score. The flaw is described as easily exploitable by a low-privileged attacker with network access over HTTP and could allow unauthorized creation, deletion, or modification of critical data, along with access to sensitive or complete accessible data. Across the three disclosures, Oracle warned that successful exploitation could result in platform compromise, data tampering, and broad unauthorized access in widely deployed enterprise management and identity systems.

Apr 21, 2026

Oracle Critical Patch Update Addresses Multiple High-Risk Enterprise Product Flaws

How this story unfolded

dCERT publishes Oracle vulnerability advisories across multiple product lines

Oracle discloses CVE-2026-34275 in E-Business Suite telephony component

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Oracle Critical Patch Update Addresses Multiple High-Risk Enterprise Product Flaws

How this story unfolded

dCERT publishes Oracle vulnerability advisories across multiple product lines

Oracle discloses CVE-2026-34275 in E-Business Suite telephony component

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Oracle Critical Patch Update Addresses Multiple High-Risk Enterprise Product Flaws

How this story unfolded

dCERT publishes Oracle vulnerability advisories across multiple product lines

Oracle discloses CVE-2026-34275 in E-Business Suite telephony component

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle ships record CPU with 1,235 CVEs, including critical E-Business Suite flaws

Oracle Issues Massive Patch Update for 925 CVEs Across Enterprise Products

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools

Oracle Critical Patch Update Addresses Multiple High-Risk Enterprise Product Flaws

How this story unfolded

dCERT publishes Oracle vulnerability advisories across multiple product lines

Oracle discloses CVE-2026-34275 in E-Business Suite telephony component

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Oracle ships record CPU with 1,235 CVEs, including critical E-Business Suite flaws

Oracle Issues Massive Patch Update for 925 CVEs Across Enterprise Products

Oracle Critical Patch Update Fixes High-Severity Flaws in Enterprise Manager, Identity Manager, and PeopleTools