Loading story…
Oracle released Solaris 11.4 Support Repository Update 95 (SRU 95), providing operating-system updates and security fixes through the standard pkg update mechanism. A Solaris 11.4 Common Build Environment image is also available for package-building workflows. The release adds ZFS zpool monitor support to track long-running pool operations and includes linker and CTF development-tooling improvements.
SRU 95 updates numerous security-relevant third-party components, including Apache HTTP Server, BIND, Firefox, MySQL, OpenSSH, Samba, Python, Node.js, Go, Rust, SQLite, and X11 software. Oracle did not identify specific CVEs or report exploitation activity in the referenced release information; organizations running Solaris 11.4 should assess and deploy the update through established change-management processes.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Oracle released Solaris 11.4 Support Repository Update 95, providing software updates and security fixes. The update is available through pkg update and as a Solaris 11.4 Common Build Environment image, and includes updates to components such as Apache HTTP Server, BIND, Firefox, MySQL, OpenSSH, Python, Node.js, Samba, and X11.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle released a **Critical Security Patch Update** containing **943 patches** for **925 unique CVEs** across **23 product families**, making it one of the company’s largest recent security releases. The update includes **154 critical patches** covering **151 CVEs**, with Oracle Fusion Middleware and Oracle Hyperion each receiving **262 patches** and Oracle E-Business Suite receiving **120**. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws. The most severe issues affect major enterprise platforms including **Oracle Internet Directory**, **Hyperion Data Relationship Management**, **Hyperion Financial Management**, and **Oracle WebLogic Server**, with some vulnerabilities rated up to **CVSS 10.0**. Additional critical flaws were reported in **Oracle Identity Manager**, **Siebel CRM Cloud**, **Helidon**, **BI Publisher**, **WebCenter**, **Oracle Payments**, and **PeopleSoft PeopleTools**. Several of the vulnerabilities are described as **unauthenticated network-exploitable** and capable of leading to **remote code execution** or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.
Aug 25, 2026
Oracle released its June 2026 Critical Patch Update with **245 security patches** affecting multiple Oracle products and third-party components. The vulnerabilities addressed could allow denial-of-service attacks, sensitive information disclosure, data manipulation, and unauthorized access, prompting guidance for enterprises to apply updates after completing testing. The update includes two maximum-severity flaws rated **CVSS 10.0**: **`CVE-2026-35308`** in **Oracle Coherence**, described as a remotely exploitable centralized takeover issue, and **`CVE-2026-46978`** in **Oracle Solaris**, described as a data manipulation vulnerability. Both flaws are reported as exploitable over the network with low attack complexity, requiring no privileges and no user interaction, increasing the urgency for organizations running affected systems to patch quickly.
Jul 9, 2026
Oracle released its September 2026 Critical Security Patch Update with **673 patches** addressing **672 CVEs** across 17 product families, including 104 critical- and 503 high-severity fixes. Oracle E-Business Suite received 159 patches and Fusion Middleware received 153. The most severe disclosed issues include `CVE-2026-73945` in Oracle Access Manager and `CVE-2026-73948` in Oracle WebCenter Portal, both rated CVSS 9.9, and `CVE-2026-60696` in Oracle WebLogic Server, rated 9.8; affected services can be remotely reachable with no authentication or limited privileges required. The update also addresses high-severity takeover and data-access flaws in Hyperion Financial Management, GraalVM, and Oracle Purchasing. `CVE-2026-87238` allows a low-privileged network attacker to take over Hyperion Financial Management 11.2.26.0.000 via SQL, while `CVE-2026-87234`, `CVE-2026-87241`, and `CVE-2026-87245` can expose or alter critical application data. Multiple GraalVM compiler flaws, including `CVE-2026-83357`, `CVE-2026-83408`, `CVE-2026-87286`, and `CVE-2026-87287`, could allow unauthenticated HTTP-based compromise despite high exploitation complexity. No active exploitation was reported; organizations should prioritize internet-facing WebLogic, identity, middleware, GraalVM, and E-Business Suite systems and restrict WebLogic T3/IIOP exposure until patching is complete.
Sep 19, 2026