Loading story…
Oracle released a Critical Security Patch Update containing 943 patches for 925 unique CVEs across 23 product families, making it one of the company’s largest recent security releases. The update includes 154 critical patches covering 151 CVEs, with Oracle Fusion Middleware and Oracle Hyperion each receiving 262 patches and Oracle E-Business Suite receiving 120. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws.
The most severe issues affect major enterprise platforms including Oracle Internet Directory, Hyperion Data Relationship Management, Hyperion Financial Management, and Oracle WebLogic Server, with some vulnerabilities rated up to CVSS 10.0. Additional critical flaws were reported in Oracle Identity Manager, Siebel CRM Cloud, Helidon, BI Publisher, WebCenter, Oracle Payments, and PeopleSoft PeopleTools. Several of the vulnerabilities are described as unauthenticated network-exploitable and capable of leading to remote code execution or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Oracle published advisory ELSA-2026-56521 for Oracle Linux 8 on August 19, 2026, releasing patches for gstreamer1-plugins-bad-free and gstreamer1-plugins-bad-free-devel. The advisory addressed CVE-2026-19387, and the Tenable plugin states no known exploits were available.
Oracle published advisory ELSA-2026-55804 for Oracle Linux 8 on August 18, 2026, releasing patches for nghttp2 packages including libnghttp2 and libnghttp2-devel. The advisory addressed CVE-2026-58055, and the Tenable plugin notes exploits were available.
Oracle published advisory ELSA-2026-55603 for Oracle Linux 9 on August 18, 2026, releasing patches for Node.js, npm, V8, and related packages. The advisory addressed multiple vulnerabilities including CVE-2026-11822, CVE-2026-11824, CVE-2026-14257, CVE-2026-54272, CVE-2026-69152, and CVE-2026-69192, and the Tenable plugin notes exploits were available.
On 2026-08-18, Amazon Corretto published the corretto-8-2026-Aug-18 advisory stating that Corretto 8 versions prior to 8.504.01.1 were affected by CVE-2026-61308, CVE-2026-60589, and CVE-2026-70907. The recommended remediation was to update to Amazon Corretto Java 8.504.01.1 or later.
On August 18, 2026, Oracle published security updates for Oracle Enterprise Manager Cloud Control as part of its August 2026 Critical Security Patch Update. The update addressed multiple vulnerabilities, including CVE-2026-2332 and several additional CVEs referenced by Tenable's detection plugin.
On August 18, 2026, Oracle released its August 2026 Critical Security Patch Update. The release delivered 943 security patches addressing 925 unique CVEs across 23 Oracle product families, including 154 critical patches covering 151 CVEs.
Oracle published advisory ELSA-2026-55446 for Oracle Linux 8 on August 17, 2026, releasing patches for libxfont2 and libxfont2-devel. The advisory addressed CVE-2026-44950 and CVE-2026-59679, and the Tenable plugin states no known exploits were available.
Oracle published advisory ELSA-2026-55440 for Oracle Linux 9 on August 17, 2026, releasing patches for glib2 and related packages. The advisory addressed multiple vulnerabilities including CVE-2026-15588 and CVE-2026-58010 through CVE-2026-58015, and the Tenable plugin notes exploits were available.
Oracle introduced its monthly Critical Security Patch Update cycle in May 2026 to deliver high-severity fixes between its larger quarterly Critical Patch Updates.
Oracle disclosed and patched more than 40 CVEs across more than 10 enterprise product lines in its August 2026 Critical Patch Update advisory, including CVSS 10.0 and 9.9 flaws affecting Oracle Internet Directory, Hyperion products, WebLogic Server, Identity Manager, Siebel CRM Cloud, Helidon, BI Publisher, WebCenter, Oracle Payments, and PeopleSoft PeopleTools. Oracle said patches were available for all affected products and that no active exploitation was known at the time of publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
21 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecsirt.bj
Open sourcevirtualbox.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle released its largest-ever Critical Patch Update, fixing **1,235 unique CVEs** with **1,449 patches** across **32 product families**, including **261 critical patches**. Oracle E-Business Suite received the highest volume with **410 patches**, while Fusion Middleware received **355**; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes **18 critical Fusion Middleware vulnerabilities** with CVSS scores up to **10.0**, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems. The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include `CVE-2026-62549` in Oracle HRMS (UK) (**CVSS 9.6**), `CVE-2026-62546` and `CVE-2026-62534` in Oracle Applications Framework (**CVSS 9.1** and takeover risk), and `CVE-2026-62547` in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.
Jul 24, 2026
Oracle released its June 2026 Critical Security Patch Update, publishing a formal advisory and a related security blog announcing fixes for vulnerabilities across a broad set of enterprise products. The update covers Oracle Communications, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Fusion Middleware, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, and Oracle Virtualization. Oracle directed customers to its Critical Security Patch Update advisory and an executive summary in My Oracle Support for detailed vulnerability information, and pointed organizations to the Oracle Trust Center for background on its remediation practices and patching program. The release signals that enterprises running affected Oracle technologies should review product-specific guidance and apply the relevant security updates as part of their vulnerability management process.
Jun 29, 2026
Oracle-related security advisories were issued for multiple enterprise products, including **Oracle Database Server**, **Oracle Fusion Middleware**, **Oracle REST Data Services**, **Oracle Java SE**, **Oracle Financial Services Applications**, and **Oracle E-Business Suite**. Germany's dCERT published separate advisories for each affected product line, indicating broad exposure across core Oracle infrastructure and business application environments. One of the disclosed flaws, **`CVE-2026-34275`**, affects the **Setup and Administration** component of **Oracle Advanced Inbound Telephony** in **Oracle E-Business Suite** versions **12.2.3 through 12.2.15**. Oracle rated the issue **critical** with a **CVSS v3.1 score of 9.8**, stating that an **unauthenticated attacker** with **network access over HTTP** could exploit it to achieve **full takeover** of the affected application. The vulnerability was disclosed as part of Oracle's broader Critical Patch Update, underscoring the need for organizations running Oracle platforms to prioritize patch review and remediation across exposed systems.
Jun 29, 2026