Loading story…
Oracle said it will replace its quarterly security patching model with monthly Critical Security Patch Updates for ERP, database, and other software products, citing the faster pace of AI-enabled vulnerability discovery. The company said the new cadence is intended to shorten exposure windows as attackers and researchers use AI to identify software flaws more quickly.
The first monthly release is scheduled for May 28, after which Oracle plans to move to a regular third-Tuesday schedule each month. Reported upcoming dates include June 16, July 21, and August 18. The move brings Oracle closer to the monthly patching approach already used by major software vendors including Microsoft, SAP, and Adobe, though those vendors typically release updates on the second Tuesday of the month.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Oracle released a security advisory detailing patches for multiple enterprise products, including severe remotely exploitable vulnerabilities such as CVE-2026-46833 in Oracle Net Service and CVE-2026-46840 in Oracle REST Data Services Backend-as-a-Service. The advisory also warned of ongoing exploitation attempts against already-patched Oracle flaws and urged immediate patching of exposed systems.
Oracle said its first monthly Critical Security Patch Update will be released on May 28 as an initial fourth-Thursday release. After that, the company plans to adopt a regular patch cadence on the third Tuesday of each month.
Oracle said it will move its ERP, database, and other software products from a quarterly security patch cadence to monthly Critical Security Patch Updates. The company cited the faster pace of AI-enabled vulnerability discovery as the reason for the change.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceoracle.com
Open sourcecio.com
Open sourceinfoworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle issued a record quarterly security update with **1,449 patches** across its product portfolio, while also shifting to monthly Critical Security Patch Updates for the most severe flaws. The company said the surge is tied largely to AI-assisted internal vulnerability discovery, and the release includes multiple high-risk issues such as `CVE-2026-47056` and `CVE-2026-60217`, both rated **CVSS 10.0** and described as remotely exploitable without authentication, alongside serious Oracle Database Server flaws including `CVE-2026-61211` and `CVE-2026-47040`. Government and industry warnings say organizations should expect a broader **patch wave** as AI accelerates both vulnerability discovery and attacker exploitation. Research on **1,646** open source CVEs linked to multiple patches found that remediation often spans several commits rather than a single fix, with **641** cases involving incomplete initial patches and **31.7%** of multi-patch fixes taking more than a day to complete, leaving residual exposure. Security agencies are urging defenders to prioritize internet-facing and critical systems, isolate or replace unsupported technology, and verify whether follow-up or branch-specific patches are still pending instead of assuming the first published fix fully closes the risk.
Jul 27, 2026
Oracle released its June 2026 Critical Security Patch Update, publishing a formal advisory and a related security blog announcing fixes for vulnerabilities across a broad set of enterprise products. The update covers Oracle Communications, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Fusion Middleware, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, and Oracle Virtualization. Oracle directed customers to its Critical Security Patch Update advisory and an executive summary in My Oracle Support for detailed vulnerability information, and pointed organizations to the Oracle Trust Center for background on its remediation practices and patching program. The release signals that enterprises running affected Oracle technologies should review product-specific guidance and apply the relevant security updates as part of their vulnerability management process.
Jun 29, 2026
Oracle released its October 2025 Critical Patch Update, addressing security vulnerabilities in a wide range of Oracle products. The advisory highlights the importance of applying the latest patches to mitigate risks associated with these vulnerabilities, which could potentially allow attackers to compromise affected systems. The update includes fixes for several critical flaws, including two severe vulnerabilities in Oracle Marketing products (CVE-2025-53072 and CVE-2025-62481) that could enable full system takeover if left unpatched. Security agencies have urged organizations to review Oracle's advisory and implement the recommended updates promptly to protect their environments. The vulnerabilities span multiple Oracle product lines, underscoring the need for comprehensive patch management and timely response to vendor advisories to reduce exposure to exploitation and potential business impact.
Jun 29, 2026