Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has released its monthly Critical Security Patch Update (CSPU) on August 18, 2026, addressing more than 900 vulnerabilities across numerous enterprise products.
The update serves as a supplement to the company's quarterly Critical Patch Update (CPU) program. In total, Oracle fixed 943 vulnerabilities, including those originating from third-party software. After accounting for duplicates across products, this equates to 925 unique CVEs.
According to CVSSv3 base scores, 710 of the vulnerabilities rated 7.0 or higher. Among them, 154 scored 9.0 or above, including three with the maximum score of 10.0, 19 rated 9.9, and 67 rated 9.8. Additionally, 467 vulnerabilities allow unauthenticated remote attacks over the network.
Products and Patch Counts
The affected products span a broad portfolio:
- Oracle Fusion Middleware received 262 security patches, including fixes for Oracle WebLogic Server.
- Oracle E-Business Suite saw 120 vulnerabilities addressed.
- Oracle Database Server received fixes for six issues.
Other covered products include Oracle Java SE, MySQL, PeopleSoft, JD Edwards, Siebel, Oracle Analytics, Oracle Enterprise Manager, Oracle Supply Chain, Oracle Commerce, Oracle Communications, and Oracle VM VirtualBox.
Oracle plans to release the next monthly update on September 15, 2026, with the next quarterly CPU scheduled for October 20, 2026.
Related articles
WordPress Core Update Flaw Draws Over 240,000 Attack Attempts Since Patch Release
Wordfence has blocked more than 240,000 attack attempts targeting a race condition vulnerability in the WordPress core update process, tracked as CVE-2026-119977 with a CVSS score of 8.1. The attempts began on October 28, the same day WordPress issued the fix, with a single-day peak exceeding 74,000 blocked requests. The flaw allows attackers to exploit predictable temporary upgrade files during the automatic core update, enabling them to complete an installation, create an administrator account, and upload malicious PHP code without any existing credentials. The vulnerability affects branches from version 4.7 through 7.1.3, with the fix available in 7.1.4 and backported releases for older lines. Because automatic updates are enabled by default on most sites, the exposure window opens silently during routine maintenance. Security researchers emphasize that the high volume of attempts does not confirm successful compromises, urging administrators to review user lists and modified files after any core update since late October.
Multiple Critical Vulnerabilities Found in OpenAM Identity Platform
Open Identity Platform disclosed 18 vulnerabilities in its OpenAM identity management platform on October 22, 2026. Three of these issues received the highest severity rating of Critical. The vulnerabilities were fixed in the OpenAM 16.1.4 release. One Critical flaw tracked as CVE-2026-123551 affects the WebSocket notification service used for session start and end events. Attackers can bypass authentication checks on WebSocket connections to leak user session tokens, enabling full session hijacking including for administrator accounts. V ulnCheck assigned a maximum CVSS v4.0 base score of 10.0 to this issue.
Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks
An automated scan of 284 large Russian websites found that 24 percent allow easy email spoofing because DMARC records are either missing or set to p=none. Nearly one quarter of readable sites still load JavaScript libraries such as jQuery versions from 2013-2016 that carry publicly known CVEs. Half the sites transmit visitor IP addresses and cookies to foreign analytics services despite privacy policies claiming otherwise. Five abandoned subdomains point to AWS and DigitalOcean addresses that could be claimed for phishing. Government sites performed no better than commercial ones on most checks. The researcher released the open-source Suveren tool so any organization can run the same tests against its own domains.
Top Cybersecurity Articles of the Week: Linux Kernel TCP Flaw Leads Security NEXT Rankings
Security NEXT has published its weekly ranking of the most-read articles for the period of November 1 to November 7, 2026. The list is dominated by critical vulnerability disclosures and patches across widely used platforms. Leading the chart is a severe flaw in the Linux kernel's IPv4 TCP connection handling that has already attracted proof-of-concept reports. Other prominent entries include remote code execution issues in WordPress, hundreds of fixes in Chrome 157, and multiple critical vulnerabilities in pgAdmin 4. The ranking also highlights confirmed exploitation of Apple product vulnerabilities and a network intrusion at Japan's Ministry of Foreign Affairs that may have exposed personal data.