InfoSecBulletin Cybersecurity for mankind
Oracle has put out 943 new security updates in its August 2026 Critical Security Patch Update. These updates fix problems in its business software. The update contains important Oracle WebLogic Server problems. These issues can let a remote attacker, who is not logged in, gain full control of the affected servers.
The update from August 18 talks about Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, PeopleSoft, Communications products, and more.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
Oracle strongly advised customers to update right away, saying that attackers have used known weaknesses when companies did not fix them.
Oracle Releases 943 Security Patches
The biggest fixes are for Oracle WebLogic Server, an application server used by big organizations to run important apps. Oracle fixed several serious problems that could be exploited from afar, with a high severity score of 9.8 out of 10.
The flaws include CVE-2026-60698, CVE-2026-60672, and CVE-2026-60696. They affect the WebLogic Server Core using the IIOP and T3 protocols.
These flaws are very risky because they can be used from afar without needing a password and can harm privacy, data correctness, and access.
A successful attacker can take unauthorized actions, steal sensitive data, change app content, disrupt business services, or gain full control of a weak WebLogic system.
Critical WebLogic vulnerabilities
CVE AFFECTED COMPONENT PROTOCOL CVSS 3.1
CVE-2026-60698 WebLogic Server Core IIOP 9.8
CVE-2026-60672 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60696 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60977 WebLogic Server WLS Core Components RMI 9.8
CVE-2026-60702 WebLogic Server Core T3, IIOP 9.9
Oracle fixed CVE-2026-60977, a serious RMI issue in WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. All of these problems got a CVSS score of 9.8.
Another serious WebLogic problem, CVE-2026-60702, has a CVSS score of 9.9. It impacts the WebLogic Core part and uses T3 or IIOP for the attack. Unlike the 9.8-rated issues, this one needs a low-level user who is logged in.
Successful exploitation could still greatly affect the system. It might lead to serious problems with data confidentiality, integrity, and availability. Oracle Fusion Middleware got 262 new security updates. 182 of these problems can be used by attackers from afar without needing permission.
This makes Fusion Middleware a very important product group in the August update. The advisory also has a serious CVSS 10.0 flaw, CVE-2026-61241, in the LDAP Server part of Oracle Internet Directory.
Oracle also fixed serious problems in other products. Oracle Commerce got 66 updates, including some that could be attacked from a distance with a CVSS score of 9.8.
Oracle E-Business Suite got 120 updates, while Oracle Database Products got 17 security fixes. Major problems were also fixed in Oracle Essbase, Enterprise Manager, Financial Services apps, and Oracle Hospitality Simphony.
Organizations should focus on WebLogic servers that are connected to the internet, especially those with T3, IIOP, or RMI services open to untrusted networks.
Security teams need to find the affected versions, get the right updates from Oracle’s Patch Availability Documents, test the updates in safe environments, and roll them out quickly when it’s workable.
Where quick fixes are not possible, admins should block access to open protocols and reduce unnecessary network reach. But Oracle warns that these workarounds do not solve the main problems.
