Loading story…
Oracle released its June 2026 Critical Patch Update with 245 security patches affecting multiple Oracle products and third-party components. The vulnerabilities addressed could allow denial-of-service attacks, sensitive information disclosure, data manipulation, and unauthorized access, prompting guidance for enterprises to apply updates after completing testing.
The update includes two maximum-severity flaws rated CVSS 10.0: CVE-2026-35308 in Oracle Coherence, described as a remotely exploitable centralized takeover issue, and CVE-2026-46978 in Oracle Solaris, described as a data manipulation vulnerability. Both flaws are reported as exploitable over the network with low attack complexity, requiring no privileges and no user interaction, increasing the urgency for organizations running affected systems to patch quickly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On June 18, 2026, Oracle released its June 2026 Critical Patch Update with 245 new security patches across Oracle products and third-party components. The update addressed vulnerabilities that could allow denial of service, sensitive information disclosure, data manipulation, or unauthorized access, including CVE-2026-35308 in Oracle Coherence and CVE-2026-46978 in Oracle Solaris.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle released its January 2026 *Critical Patch Update (CPU)*, delivering **337 security updates addressing 158 unique CVEs** across roughly 30 product families; **27** of the updates were rated **critical**. Tenable’s analysis highlights broad exposure to remotely exploitable issues without authentication across multiple Oracle product lines, and notes **CVE-2026-21945**, a high-severity **SSRF** issue in Oracle Java, was discovered by Tenable Research. A standout issue in the CPU is **CVE-2026-21962** (CVSS **10.0**), an **easily exploitable, unauthenticated, network-reachable (HTTP)** vulnerability in Oracle Fusion Middleware components **Oracle HTTP Server** and the **WebLogic Server Proxy Plug-ins** (Apache and IIS). Successful exploitation can enable **unauthorized creation, deletion, or modification of critical data** and potentially broader downstream impact due to a **scope change** (`S:C`), meaning compromise may significantly affect additional products; affected versions include **12.2.1.4.0**, **14.1.1.0.0**, and **14.1.2.0.0** (with the IIS proxy plug-in affected in **12.2.1.4.0** only).
Jun 29, 2026
Oracle released its June 2026 Critical Security Patch Update, publishing a formal advisory and a related security blog announcing fixes for vulnerabilities across a broad set of enterprise products. The update covers Oracle Communications, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Fusion Middleware, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, and Oracle Virtualization. Oracle directed customers to its Critical Security Patch Update advisory and an executive summary in My Oracle Support for detailed vulnerability information, and pointed organizations to the Oracle Trust Center for background on its remediation practices and patching program. The release signals that enterprises running affected Oracle technologies should review product-specific guidance and apply the relevant security updates as part of their vulnerability management process.
Jun 29, 2026
Oracle released its October 2025 Critical Patch Update, addressing security vulnerabilities in a wide range of Oracle products. The advisory highlights the importance of applying the latest patches to mitigate risks associated with these vulnerabilities, which could potentially allow attackers to compromise affected systems. The update includes fixes for several critical flaws, including two severe vulnerabilities in Oracle Marketing products (CVE-2025-53072 and CVE-2025-62481) that could enable full system takeover if left unpatched. Security agencies have urged organizations to review Oracle's advisory and implement the recommended updates promptly to protect their environments. The vulnerabilities span multiple Oracle product lines, underscoring the need for comprehensive patch management and timely response to vendor advisories to reduce exposure to exploitation and potential business impact.
Jun 29, 2026