Loading story…
Oracle released its October 2026 Critical Patch Update with 1,295 security updates addressing 1,209 unique CVEs across 33 product families, including 112 critical patches covering 95 CVEs. Fusion Middleware received 206 patches and E-Business Suite received 194, with both product families containing vulnerabilities exploitable remotely without authentication. The release also includes 109 PeopleSoft fixes, 124 Oracle Communications fixes, 33 Oracle Analytics fixes and 13 Database patches.
A priority fix is CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection vulnerability in E-Business Suite’s Thin Client Framework servlet affecting Oracle Application Object Library versions 12.2.3–12.2.15. Horizon3.ai reported that attackers with HTTP or HTTPS access to /OA_HTML/AppsTCFServer can execute SQL as the APPS database user and chain the flaw to run operating system commands as the EBS application account. Uganda’s National CERT separately warned of renewed PeopleSoft mass-exploitation attempts linked to ShinyHunters actors, following reported zero-day exploitation earlier in 2026. Organizations should prioritize patches for internet-facing EBS and PeopleSoft deployments and systems holding sensitive data. Pending EBS patching, restrict web-tier access, remove the affected servlet from the EBS URL firewall allowlist and monitor application and database activity; these measures do not replace the fix.
See which actors are running it and whether you're in range.
28 events from the most recent confirmed update back to the earliest known activity.
A new CVE record identified a CVSS 8.8 vulnerability in the Dictionary Repository component of Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with SQL network access could take over Oracle Data Integrator without user interaction; the supplied record does not describe active exploitation.
A new CVE record received from Oracle identified a CVSS 9.1 vulnerability in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An unauthenticated attacker with HTTP network access could read, create, delete, or modify critical or all application-accessible data without user interaction; the supplied content reports no exploitation in the wild.
A new CVE record received from Oracle identified a CVSS 9.8 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. An unauthenticated attacker with TCP network access could easily take over Essbase without user interaction; the supplied content reports no active exploitation.
A new CVE record received from Oracle identified a CVSS 8.1 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. The difficult-to-exploit flaw allows an unauthenticated attacker with T3 or IIOP network access to take over Essbase without user interaction; the supplied record reports no active exploitation.
A new CVE record received from Oracle identified a CVSS 9.9 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could take over Essbase without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 8.8 vulnerability in Oracle BI Publisher's BI Platform Security component affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. An unauthenticated attacker with HTTP network access could take over the application with interaction from someone other than the attacker; the supplied history reports no exploitation in the wild.
A new CVE record received from Oracle identified a CVSS 8.8 vulnerability in Oracle OLAP affecting Oracle Database Server versions 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3. A low-privileged attacker with DBMS_AW privilege and Oracle Net network access could take over Oracle OLAP without user interaction.
A new CVE record received from Oracle identified a CVSS 9.9 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with T3 or IIOP network access could take over Essbase without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 9.1 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could access critical data, modify some data, and cause partial denial of service without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 9.3 vulnerability in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An unauthenticated attacker with HTTP network access could read or modify critical data with interaction from another person, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 8.3 vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0. The difficult-to-exploit flaw allows an unauthenticated attacker with access to the hardware's physical communication segment to take over the application without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 9.9 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could take over Essbase without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 9.1 vulnerability in the Federated Partitions component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could access all accessible data, modify some data, and cause partial denial of service without user interaction, with potential impacts on additional products.
A new CVE record received from Oracle identified a CVSS 9.9 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could take over Essbase without user interaction, with potential significant impacts on additional products.
A new CVE record received from Oracle identified a CVSS 8.5 vulnerability in the Essbase Web Platform component of Oracle Essbase 21.8.3.0.0. The difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to take over Essbase without user interaction, with potential impacts on additional products.
A new CVE record identified a CVSS 8.2 vulnerability in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An unauthenticated attacker with HTTP network access could access critical data and modify some accessible data without user interaction; the supplied content reports no active exploitation.
A new CVE record received from Oracle identified a CVSS 8.5 vulnerability in the Essbase Web Platform component of Oracle Essbase 21.8.3.0.0. A low-privileged attacker with HTTP network access could access critical data and modify some accessible data without user interaction, with potential impacts on additional products.
A new CVE record received from Oracle identified a CVSS 8.2 vulnerability in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An unauthenticated attacker with HTTP network access could access critical data and modify some accessible data without user interaction; the supplied content reports no exploitation in the wild.
A new CVE record received from Oracle identified a CVSS 8.8 vulnerability in the General component of Oracle REST Data Services versions 24.2.0 through 26.2.2. A low-privileged attacker with HTTP network access could take over the service without user interaction; the supplied history reports no exploitation in the wild.
A new CVE record identified a CVSS 9.3 vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. An unauthenticated attacker could exploit it over HTTP without user interaction to access critical data and modify some accessible data, with potential impacts on additional products.
A new CVE record received from Oracle identified an 8.1-severity vulnerability in the Security component of Oracle Essbase 21.8.3.0.0. The difficult-to-exploit flaw allows an unauthenticated attacker with TCP network access to take over Essbase without user interaction; the supplied history reports no active exploitation.
A new CVE record identified an 8.8-severity vulnerability in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. A low-privileged attacker with HTTP network access could take over the application without user interaction; the reference reports no active exploitation.
Oracle released its October 2026 Critical Patch Update, which Tenable reported contained 1,295 security updates addressing 1,209 unique CVEs across 33 product families. The release included fixes for CVE-2026-101767, the critical E-Business Suite SQL injection vulnerability that can lead to remote code execution.
Horizon3.ai disclosed CVE-2026-101767 to Oracle, an unauthenticated SQL injection vulnerability affecting E-Business Suite versions 12.2.3 through 12.2.15. The flaw can be chained to achieve remote code execution.
Uganda’s National CERT reported that Oracle PeopleSoft was exploited as a zero-day earlier in 2026. The notice did not identify the vulnerability or provide technical exploitation details.
Heise reported that Oracle VM VirtualBox 7.2.22 was available for download while its integrated updater still considered version 7.2.20 current. The article also identified high-risk security vulnerabilities affecting VirtualBox.
Horizon3.ai published technical details showing how unauthenticated requests to /OA_HTML/AppsTCFServer could execute SQL as the APPS database user and operating system commands as the EBS application account. The research also identified potential compromise indicators and interim access restrictions, while reporting no confirmed exploitation in the wild.
Uganda’s National CERT reported renewed mass exploitation attempts against Oracle PeopleSoft by ShinyHunters-linked actors. The notice cited exploitation history as a reason to prioritize patching PeopleSoft and E-Business Suite.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
28 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecsirt.sk
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcetenable.com
Open sourcehorizon3.ai
Open sourcecert.ug
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle released its largest-ever Critical Patch Update, fixing **1,235 unique CVEs** with **1,449 patches** across **32 product families**, including **261 critical patches**. Oracle E-Business Suite received the highest volume with **410 patches**, while Fusion Middleware received **355**; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes **18 critical Fusion Middleware vulnerabilities** with CVSS scores up to **10.0**, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems. The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include `CVE-2026-62549` in Oracle HRMS (UK) (**CVSS 9.6**), `CVE-2026-62546` and `CVE-2026-62534` in Oracle Applications Framework (**CVSS 9.1** and takeover risk), and `CVE-2026-62547` in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.
Jul 24, 2026
Oracle released its September 2026 Critical Security Patch Update with **673 patches** addressing **672 CVEs** across 17 product families, including 104 critical- and 503 high-severity fixes. Oracle E-Business Suite received 159 patches and Fusion Middleware received 153. The most severe disclosed issues include `CVE-2026-73945` in Oracle Access Manager and `CVE-2026-73948` in Oracle WebCenter Portal, both rated CVSS 9.9, and `CVE-2026-60696` in Oracle WebLogic Server, rated 9.8; affected services can be remotely reachable with no authentication or limited privileges required. The update also addresses high-severity takeover and data-access flaws in Hyperion Financial Management, GraalVM, and Oracle Purchasing. `CVE-2026-87238` allows a low-privileged network attacker to take over Hyperion Financial Management 11.2.26.0.000 via SQL, while `CVE-2026-87234`, `CVE-2026-87241`, and `CVE-2026-87245` can expose or alter critical application data. Multiple GraalVM compiler flaws, including `CVE-2026-83357`, `CVE-2026-83408`, `CVE-2026-87286`, and `CVE-2026-87287`, could allow unauthenticated HTTP-based compromise despite high exploitation complexity. No active exploitation was reported; organizations should prioritize internet-facing WebLogic, identity, middleware, GraalVM, and E-Business Suite systems and restrict WebLogic T3/IIOP exposure until patching is complete.
Sep 19, 2026
Oracle released a **Critical Security Patch Update** containing **943 patches** for **925 unique CVEs** across **23 product families**, making it one of the company’s largest recent security releases. The update includes **154 critical patches** covering **151 CVEs**, with Oracle Fusion Middleware and Oracle Hyperion each receiving **262 patches** and Oracle E-Business Suite receiving **120**. Oracle said its monthly CSPU program, introduced between quarterly Critical Patch Updates, is intended to accelerate fixes for high-severity flaws. The most severe issues affect major enterprise platforms including **Oracle Internet Directory**, **Hyperion Data Relationship Management**, **Hyperion Financial Management**, and **Oracle WebLogic Server**, with some vulnerabilities rated up to **CVSS 10.0**. Additional critical flaws were reported in **Oracle Identity Manager**, **Siebel CRM Cloud**, **Helidon**, **BI Publisher**, **WebCenter**, **Oracle Payments**, and **PeopleSoft PeopleTools**. Several of the vulnerabilities are described as **unauthenticated network-exploitable** and capable of leading to **remote code execution** or full host compromise, prompting urgent patching recommendations for exposed systems, particularly WebLogic Server and other internet-facing Oracle services.
Aug 25, 2026