LIVE · cybersecurity feed
Live wire
vendor1 exploited in the wild

Oracle

300 CVEs published in the last four months and 12 stories. Exploited flaws first.

Critical300
High0
Medium0
Exploited (KEV)1

Patch these first

CVECVSSSeverityProductSummaryPublished
CVE-2026-35273exploited9.8criticalpeoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environmen132d ago

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-4680310criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).126d ago
CVE-2026-4684010criticalrest data servicesVulnerability in Oracle REST Data Services (component: Backend-as-a-Service).145d ago
CVE-2026-4680010criticalwebcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).126d ago
CVE-2026-4684610criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).126d ago
CVE-2026-6021710criticalcoherenceVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).91d ago
CVE-2026-3529210criticalweblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).126d ago
CVE-2026-6064410criticalwebcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme91d ago
CVE-2026-7088010criticalhyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an63d ago
CVE-2026-4705610criticaldata integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service).91d ago
CVE-2026-3530710criticalcoherenceVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).126d ago
CVE-2026-3530110criticalweblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).126d ago
CVE-2026-6036510criticalhttp serverVulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic91d ago
CVE-2026-6038910criticalservice delivery platformVulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).91d ago
CVE-2026-3530810criticalcoherenceVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars126d ago
CVE-2026-6035810criticalaccess managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).91d ago
CVE-2026-4679810criticalwebcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).126d ago
CVE-2026-4677810criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-6036610criticalplatform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized90d ago
CVE-2026-6124110criticalinternet directoryVulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).63d ago
CVE-2026-6037910criticalservice delivery platformVulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).91d ago
CVE-2026-6036010criticalunified directoryVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).91d ago
CVE-2026-7092110criticalhyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).63d ago
CVE-2026-4697810criticalsolarisVulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon).126d ago
CVE-2026-4678110criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-625889.9criticalsiebel crmVulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).63d ago
CVE-2026-610729.9criticalpeoplesoft enterprise fin staffing front office brazilVulnerability in the PeopleSoft Enterprise FIN Staffing Front Office Brazil product of Oracle PeopleSoft (componen91d ago
CVE-2026-468249.9criticaluniversal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site145d ago
CVE-2026-606279.9criticaljd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security91d ago
CVE-2026-468559.9criticalenterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Meta126d ago
CVE-2026-709209.9criticalhyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).63d ago
CVE-2026-613179.9criticalsiebel crmVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).63d ago
CVE-2026-605249.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu91d ago
CVE-2026-609909.9criticalidentity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).63d ago
CVE-2026-603819.9criticalservice delivery platformVulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).91d ago
CVE-2026-612429.9criticalpeoplesoft enterprise fin common objectsVulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: S91d ago
CVE-2026-609959.9criticalidentity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).63d ago
CVE-2026-607309.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).63d ago
CVE-2026-610219.9criticalwebcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).63d ago
CVE-2026-605429.9criticalbusiness process management suiteVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Huma91d ago
CVE-2026-352829.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-605629.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).91d ago
CVE-2026-468959.9criticalenterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor126d ago
CVE-2026-467799.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-469019.9criticalenterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor126d ago
CVE-2026-469089.9criticaljd edwards enterpriseone accounts payableVulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts P126d ago
CVE-2026-352849.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-605529.9criticalwebcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).91d ago
CVE-2026-352819.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-605619.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).91d ago
CVE-2026-467939.9criticalidentity manager connectorVulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User).126d ago
CVE-2026-605379.9criticalmanaged file transferVulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Serv91d ago
CVE-2026-607119.9criticalsiebel crmVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).91d ago
CVE-2026-605659.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).91d ago
CVE-2026-607209.9criticalidentity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).63d ago
CVE-2026-467929.9criticalidentity manager connectorVulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Conne126d ago
CVE-2026-468449.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).126d ago
CVE-2026-624529.9criticalsiebel crmVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).63d ago
CVE-2026-469649.9criticaluniversal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site126d ago
CVE-2026-604229.9criticalunified directoryVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).91d ago
CVE-2026-468549.9criticalenterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Targ126d ago
CVE-2026-604029.9criticaltimesten in-memory databaseVulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kuberne91d ago
CVE-2026-710599.9criticalbi publisherVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).63d ago
CVE-2026-467829.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-612099.9criticalpeoplesoft in-memory project discoveryVulnerability in the PeopleSoft In-Memory Project Discovery product of Oracle PeopleSoft (component: Project Disco91d ago
CVE-2026-602069.9criticalweblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).91d ago
CVE-2026-612379.9criticalpeoplesoft enterprise fin common objectsVulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: I91d ago
CVE-2026-603339.9criticalaccess managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).91d ago
CVE-2026-469009.9criticalenterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor126d ago
CVE-2026-604619.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu91d ago
CVE-2026-603699.9criticalplatform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized90d ago
CVE-2026-607199.9criticalbi publisherVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).91d ago
CVE-2026-604569.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu91d ago
CVE-2026-604579.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu91d ago
CVE-2026-612489.9criticalinternet directoryVulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).63d ago
CVE-2026-468149.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).126d ago
CVE-2026-604599.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu91d ago
CVE-2026-605479.9criticalmanaged file transferVulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Serv91d ago
CVE-2026-352639.9criticalweblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core).126d ago
CVE-2026-607029.9criticalweblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).63d ago
CVE-2026-606639.9criticalwebcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme91d ago
CVE-2026-603619.9criticalunified directoryVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).91d ago
CVE-2026-467759.9criticalrest data servicesVulnerability in Oracle REST Data Services (component: Core).145d ago
CVE-2026-467949.9criticalidentity manager connectorVulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Conne126d ago
CVE-2026-352949.9criticalidentity managerVulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connecto126d ago
CVE-2026-469339.9criticalapplications managerVulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operation126d ago
CVE-2026-468939.9criticaljd edwards enterpriseone general ledgerVulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundatio126d ago
CVE-2026-467659.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).126d ago
CVE-2026-469189.9criticalprocess manufacturing product developmentVulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (componen126d ago
CVE-2026-467679.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).126d ago
CVE-2026-468399.9criticalrest data servicesVulnerability in Oracle REST Data Services (component: Core).145d ago
CVE-2026-352839.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-469079.9criticaljd edwards enterpriseone global order promisingVulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promi126d ago
CVE-2026-468479.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).126d ago
CVE-2026-352859.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu126d ago
CVE-2026-609169.9criticalwebcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu63d ago
CVE-2026-625129.9criticalsiebel crmVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).63d ago
CVE-2026-469639.9criticaluniversal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site126d ago
CVE-2026-468979.9criticalenterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor126d ago
CVE-2026-468509.9criticalmysql shellVulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).126d ago
CVE-2026-605689.9criticalwebcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).91d ago

Filter the full tracker by Oracle →

Our coverage of Oracle

vulnerabilitycritical

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle released its September 2026 Critical Security Patch Update (CSPU) on September 15, addressing 672 unique Common Vulnerabilities and Exposures (CVEs) through 673 security updates across 17 product families. This monthly release cycle, introduced in May 2026, aims to provide a faster cadence for high-severity issues compared to the quarterly Critical Patch Updates (CPUs).

patch

You could've applied all 1,449 Oracle patches and still been hit by this attack

A recent credential theft incident targeting an Oracle database server would not have been prevented by any of the 1,449 patches Oracle released in late July, according to cybersecurity firm Huntress. The attack highlights a shift in threat actor tactics toward exploiting system functionality rather than solely identifying vulnerabilities.

vulnerability

CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a three-day patching directive for a critical Oracle vulnerability, CVE-2026-21962, which has been actively exploited in the wild. This is CISA's most urgent deadline, requiring federal civilian executive branch (FCEB) agencies to apply patches by August 27.

CVE-2026-21962

CISA Warns of Exploited Oracle WebLogic Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding an actively exploited vulnerability in Oracle WebLogic Server. The flaw, identified as CVE-2026-21962, is reportedly being widely leveraged by various threat actors targeting WebLogic installations.

CVE-2026-21962critical

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw affecting Oracle WebLogic Server and Oracle HTTP Server to its Known Exploited Vulnerabilities (KEV) catalog. The agency cited evidence of active exploitation for this maximum-severity vulnerability.

vulnerabilitycritical

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle has released its August 2026 Critical Patch Update, addressing a total of 943 security vulnerabilities across its diverse product portfolio. The update includes patches for various product families, with some vulnerabilities impacting multiple products and incorporating fixes for third-party components.

vulnerability

943 Patches Rolled Out With Oracle’s August 2026 Security Update

Oracle has released its August 2026 Critical Patch Update (CPU), which includes 943 security fixes addressing a wide array of vulnerabilities across its product portfolio. This extensive update resolves over 1,000 individual vulnerabilities, with a significant portion of these issues being remotely exploitable.

vulnerabilitycritical

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle has released its August 2026 Critical Security Patch Update (CSPU), addressing 925 unique Common Vulnerabilities and Exposures (CVEs) through 943 security updates across 23 of its product families. This update includes 154 critical severity patches, accounting for 16.3% of the total fixes.

security

Toolkit Hidden Inside Oracle Database Evades Endpoint Tools

A post-exploitation toolkit has been discovered compiled and stored within an Oracle database as schema objects, allowing attackers to execute commands on the underlying Windows server from a location typically not inspected by conventional endpoint security tools.

breach

Hackers run khunt post-exploitation toolkit from Oracle database

Attackers successfully exploited a SQL injection vulnerability to install a post-exploitation toolkit directly within an Oracle database, subsequently breaching a corporate network. The incident was detected by Huntress on July 27, 2026, after its security platform identified credential theft on a server hosting the compromised Oracle database.

vulnerability

Oracle drops 1,449 security patches like it's the new normal

Oracle has released a record 1,449 security patches as part of its quarterly update cycle, a number that security experts suggest reflects a growing trend in the industry driven by the increasing use of artificial intelligence in vulnerability detection. This substantial volume of fixes spans Oracle's extensive product portfolio.

vulnerabilitycritical

Oracle Critical Patch Update, July 2026 Security Update Review

Oracle has released its third quarterly Critical Patch Update for 2026, addressing a total of 1449 security vulnerabilities across its extensive product portfolio. This update, issued on July 22, 2026, includes patches for both Oracle-developed components and third-party open-source components integrated into Oracle products. Approximately 86% of the patches, or 1235 of the 1449, are for…