InfoSecBulletin Cybersecurity for mankind
Oracle has fixed over 1,400 security holes in its July 2026 Critical Patch Update (CPU). Most of these flaws were probably found by artificial intelligence. According to Oracle, the latest quarterly CPU includes 1,449 security patches, addressing 1,434 unique CVEs across 334 products.
Vulnerabilities have been fixed in products like Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
Security updates are also ready for Enterprise Manager, Financial Services Apps, Food and Beverage Apps, Fusion Middleware, Analytics, HealthCare Apps, Hospitality Apps, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Apps, Siebel CRM, Supply Chain, Systems, Utilities Apps, and Virtualization.
About 600 patches fix flaws that can be attacked from far away without needing a login. Many security issues have been given a high severity rating.
The highest numbers of vulnerabilities were patched in E-Business Suite (410), Fusion Middleware (355), Communications (168), and PeopleSoft (84).
Most of the new security problems were found inside the company, probably with help from AI. Only a small number of issues were discovered by outside researchers.
Oracle said earlier this year that it can use advanced AI systems like Anthropic’s Claude Mythos and OpenAI’s best models. They are using these systems to find and fix security issues faster and better.
The company said it is using this AI-based security work on its own software and services, Oracle Health, and the open-source parts it creates and depends on.
Organizations need to apply the latest updates quickly because hackers often take advantage of weaknesses in Oracle products. For example, there was a PeopleSoft zero-day attack and a new fix for an EBS weakness.
For security teams, this July CPU is a clear signal to:
Prioritize patching of internet‑facing Oracle assets and high‑privilege application tiers.
Integrate Oracle’s monthly CSPUs and quarterly CPUs into vulnerability management SLAs.
Track AI‑discovered CVEs and map them to MITRE ATT&CK techniques to understand likely attack paths.
Use compensating controls (WAF, network segmentation, virtual patching) where immediate patching is operationally difficult.
