Loading story…
Oracle released its September 2026 Critical Security Patch Update with 673 patches addressing 672 CVEs across 17 product families, including 104 critical- and 503 high-severity fixes. Oracle E-Business Suite received 159 patches and Fusion Middleware received 153. The most severe disclosed issues include CVE-2026-73945 in Oracle Access Manager and CVE-2026-73948 in Oracle WebCenter Portal, both rated CVSS 9.9, and CVE-2026-60696 in Oracle WebLogic Server, rated 9.8; affected services can be remotely reachable with no authentication or limited privileges required.
The update also addresses high-severity takeover and data-access flaws in Hyperion Financial Management, GraalVM, and Oracle Purchasing. CVE-2026-87238 allows a low-privileged network attacker to take over Hyperion Financial Management 11.2.26.0.000 via SQL, while CVE-2026-87234, CVE-2026-87241, and CVE-2026-87245 can expose or alter critical application data. Multiple GraalVM compiler flaws, including CVE-2026-83357, CVE-2026-83408, CVE-2026-87286, and CVE-2026-87287, could allow unauthenticated HTTP-based compromise despite high exploitation complexity. No active exploitation was reported; organizations should prioritize internet-facing WebLogic, identity, middleware, GraalVM, and E-Business Suite systems and restrict WebLogic T3/IIOP exposure until patching is complete.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Oracle released its September 2026 CSPU, delivering 673 patches for 672 unique CVEs across 17 product families. The release included 104 critical-severity patches and affected major product lines including Oracle E-Business Suite and Oracle Fusion Middleware.
Oracle introduced monthly Critical Security Patch Updates (CSPUs) between its larger quarterly Critical Patch Updates to remediate a focused set of high-severity issues more quickly.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcethecyberthrone.in
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle released a **Critical Security Patch Update** containing **943 patches** for **925 unique CVEs** across **23 product families**, making it one of the company’s largest recent security releases. The update includes **154 critical patches** covering **151 CVEs**, with Oracle Fusion Middleware and Oracle Hyperion each receiving **262 patches** and Oracle E-Business Suite receiving **120**. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws. The most severe issues affect major enterprise platforms including **Oracle Internet Directory**, **Hyperion Data Relationship Management**, **Hyperion Financial Management**, and **Oracle WebLogic Server**, with some vulnerabilities rated up to **CVSS 10.0**. Additional critical flaws were reported in **Oracle Identity Manager**, **Siebel CRM Cloud**, **Helidon**, **BI Publisher**, **WebCenter**, **Oracle Payments**, and **PeopleSoft PeopleTools**. Several of the vulnerabilities are described as **unauthenticated network-exploitable** and capable of leading to **remote code execution** or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.
Aug 25, 2026
Oracle released its largest-ever Critical Patch Update, fixing **1,235 unique CVEs** with **1,449 patches** across **32 product families**, including **261 critical patches**. Oracle E-Business Suite received the highest volume with **410 patches**, while Fusion Middleware received **355**; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes **18 critical Fusion Middleware vulnerabilities** with CVSS scores up to **10.0**, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems. The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include `CVE-2026-62549` in Oracle HRMS (UK) (**CVSS 9.6**), `CVE-2026-62546` and `CVE-2026-62534` in Oracle Applications Framework (**CVSS 9.1** and takeover risk), and `CVE-2026-62547` in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.
Jul 24, 2026
Oracle released its January 2026 *Critical Patch Update (CPU)*, delivering **337 security updates addressing 158 unique CVEs** across roughly 30 product families; **27** of the updates were rated **critical**. Tenable’s analysis highlights broad exposure to remotely exploitable issues without authentication across multiple Oracle product lines, and notes **CVE-2026-21945**, a high-severity **SSRF** issue in Oracle Java, was discovered by Tenable Research. A standout issue in the CPU is **CVE-2026-21962** (CVSS **10.0**), an **easily exploitable, unauthenticated, network-reachable (HTTP)** vulnerability in Oracle Fusion Middleware components **Oracle HTTP Server** and the **WebLogic Server Proxy Plug-ins** (Apache and IIS). Successful exploitation can enable **unauthorized creation, deletion, or modification of critical data** and potentially broader downstream impact due to a **scope change** (`S:C`), meaning compromise may significantly affect additional products; affected versions include **12.2.1.4.0**, **14.1.1.0.0**, and **14.1.2.0.0** (with the IIS proxy plug-in affected in **12.2.1.4.0** only).
Jun 29, 2026