Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has released its monthly Critical Security Patch Update (CSPU) on August 18, 2026, addressing more than 900 vulnerabilities across numerous enterprise products.
The update serves as a supplement to the company's quarterly Critical Patch Update (CPU) program. In total, Oracle fixed 943 vulnerabilities, including those originating from third-party software. After accounting for duplicates across products, this equates to 925 unique CVEs.
According to CVSSv3 base scores, 710 of the vulnerabilities rated 7.0 or higher. Among them, 154 scored 9.0 or above, including three with the maximum score of 10.0, 19 rated 9.9, and 67 rated 9.8. Additionally, 467 vulnerabilities allow unauthenticated remote attacks over the network.
Products and Patch Counts
The affected products span a broad portfolio:
- Oracle Fusion Middleware received 262 security patches, including fixes for Oracle WebLogic Server.
- Oracle E-Business Suite saw 120 vulnerabilities addressed.
- Oracle Database Server received fixes for six issues.
Other covered products include Oracle Java SE, MySQL, PeopleSoft, JD Edwards, Siebel, Oracle Analytics, Oracle Enterprise Manager, Oracle Supply Chain, Oracle Commerce, Oracle Communications, and Oracle VM VirtualBox.
Oracle plans to release the next monthly update on September 15, 2026, with the next quarterly CPU scheduled for October 20, 2026.
Related articles
PoC Exploit Released for Android CVE-2026-0075 Allowing Contact Theft Without READ_CONTACTS Permission
A researcher has published a proof-of-concept exploit for CVE-2026-0075 affecting Android 14, 15, 16 and 16 QPR2. The flaw resided in the ContactsProvider2 component and enabled local applications to extract contact database entries through SQL injection and verbose SQLite error responses, bypassing the need for any user-granted permissions. Google rated the issue high severity and addressed it in the June 2026 security bulletin by stripping detailed JSON error information from responses to unprivileged apps. The publicly available PoC on GitHub deliberately avoids requesting READ_CONTACTS or WRITE_CONTACTS and is intended strictly for lab comparison of patched versus vulnerable builds. No confirmed in-the-wild exploitation has been observed yet, but the release of working code increases risk for devices running older firmware. Users are advised to verify that their devices have received the security patch dated 5 June 2026 or later.
Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway products. CVE-2026-19490 permits authentication bypass via an alternate path when the appliances operate as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, or when configured as authentication, authorization, and auditing virtual servers. CVE-2026-19489 is a buffer overflow in LSN groups with SIP ALG enabled that can lead to unexpected behavior or denial of service. Both issues received CVSS v4.0 base scores of 9.3 and 8.8 respectively. Fixed builds 14.1-73.32 and 13.1-63.21 are now available along with corresponding FIPS and NDcPP updates.
Microsoft Releases Fix for Windows Defender Crashes During Quick and Full Scans
Microsoft has issued a security intelligence update to resolve a crash in Windows Defender that occurred during quick or full system scans on affected Windows 10 and Windows 11 devices. The bug, introduced after a recent set of patches, caused the antivirus service to terminate unexpectedly with the message "Threat service has stopped. Restart it" and access violation error 0xc0000005. Some users misinterpreted the repeated failures as malware infection or severe system damage, leading them to reinstall Windows entirely. Administrators were able to reproduce the issue consistently across multiple machines simply by initiating a quick scan, confirming the root cause lay in Defender itself rather than individual endpoints. The fix is included in security intelligence version 1.457.236.0 and all subsequent releases, with Microsoft advising users to ensure automatic updates are applied via Windows Update or manually through the Windows Security interface.
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.