InfoSecBulletin Cybersecurity for mankind
Oracle has put out 943 new security updates in its August 2026 Critical Security Patch Update. These updates fix problems in its business software. The update contains important Oracle WebLogic Server problems. These issues can let a remote attacker, who is not logged in, gain full control of the affected servers.
The update from August 18 talks about Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, PeopleSoft, Communications products, and more.
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVDÂ in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Oracle strongly advised customers to update right away, saying that attackers have used known weaknesses when companies did not fix them.
Oracle Releases 943 Security Patches
The biggest fixes are for Oracle WebLogic Server, an application server used by big organizations to run important apps. Oracle fixed several serious problems that could be exploited from afar, with a high severity score of 9.8 out of 10.
The flaws include CVE-2026-60698, CVE-2026-60672, and CVE-2026-60696. They affect the WebLogic Server Core using the IIOP and T3 protocols.
These flaws are very risky because they can be used from afar without needing a password and can harm privacy, data correctness, and access.
A successful attacker can take unauthorized actions, steal sensitive data, change app content, disrupt business services, or gain full control of a weak WebLogic system.
Critical WebLogic vulnerabilities
CVE AFFECTED COMPONENT PROTOCOL CVSS 3.1
CVE-2026-60698 WebLogic Server Core IIOP 9.8
CVE-2026-60672 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60696 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60977 WebLogic Server WLS Core Components RMI 9.8
CVE-2026-60702 WebLogic Server Core T3, IIOP 9.9
Oracle fixed CVE-2026-60977, a serious RMI issue in WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. All of these problems got a CVSS score of 9.8.
Another serious WebLogic problem, CVE-2026-60702, has a CVSS score of 9.9. It impacts the WebLogic Core part and uses T3 or IIOP for the attack. Unlike the 9.8-rated issues, this one needs a low-level user who is logged in.
Successful exploitation could still greatly affect the system. It might lead to serious problems with data confidentiality, integrity, and availability. Oracle Fusion Middleware got 262 new security updates. 182 of these problems can be used by attackers from afar without needing permission.
This makes Fusion Middleware a very important product group in the August update. The advisory also has a serious CVSS 10.0 flaw, CVE-2026-61241, in the LDAP Server part of Oracle Internet Directory.
Oracle also fixed serious problems in other products. Oracle Commerce got 66 updates, including some that could be attacked from a distance with a CVSS score of 9.8.
Oracle E-Business Suite got 120 updates, while Oracle Database Products got 17 security fixes. Major problems were also fixed in Oracle Essbase, Enterprise Manager, Financial Services apps, and Oracle Hospitality Simphony.
Organizations should focus on WebLogic servers that are connected to the internet, especially those with T3, IIOP, or RMI services open to untrusted networks.
Security teams need to find the affected versions, get the right updates from Oracle’s Patch Availability Documents, test the updates in safe environments, and roll them out quickly when it’s workable.
Where quick fixes are not possible, admins should block access to open protocols and reduce unnecessary network reach. But Oracle warns that these workarounds do not solve the main problems.
