InfoSecBulletin Cybersecurity for mankind
Oracle has put out 943 new security updates in its August 2026 Critical Security Patch Update. These updates fix problems in its business software. The update contains important Oracle WebLogic Server problems. These issues can let a remote attacker, who is not logged in, gain full control of the affected servers.
The update from August 18 talks about Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, PeopleSoft, Communications products, and more.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Oracle strongly advised customers to update right away, saying that attackers have used known weaknesses when companies did not fix them.
Oracle Releases 943 Security Patches
The biggest fixes are for Oracle WebLogic Server, an application server used by big organizations to run important apps. Oracle fixed several serious problems that could be exploited from afar, with a high severity score of 9.8 out of 10.
The flaws include CVE-2026-60698, CVE-2026-60672, and CVE-2026-60696. They affect the WebLogic Server Core using the IIOP and T3 protocols.
These flaws are very risky because they can be used from afar without needing a password and can harm privacy, data correctness, and access.
A successful attacker can take unauthorized actions, steal sensitive data, change app content, disrupt business services, or gain full control of a weak WebLogic system.
Critical WebLogic vulnerabilities
CVE AFFECTED COMPONENT PROTOCOL CVSS 3.1
CVE-2026-60698 WebLogic Server Core IIOP 9.8
CVE-2026-60672 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60696 WebLogic Server Core T3, IIOP 9.8
CVE-2026-60977 WebLogic Server WLS Core Components RMI 9.8
CVE-2026-60702 WebLogic Server Core T3, IIOP 9.9
Oracle fixed CVE-2026-60977, a serious RMI issue in WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. All of these problems got a CVSS score of 9.8.
Another serious WebLogic problem, CVE-2026-60702, has a CVSS score of 9.9. It impacts the WebLogic Core part and uses T3 or IIOP for the attack. Unlike the 9.8-rated issues, this one needs a low-level user who is logged in.
Successful exploitation could still greatly affect the system. It might lead to serious problems with data confidentiality, integrity, and availability. Oracle Fusion Middleware got 262 new security updates. 182 of these problems can be used by attackers from afar without needing permission.
This makes Fusion Middleware a very important product group in the August update. The advisory also has a serious CVSS 10.0 flaw, CVE-2026-61241, in the LDAP Server part of Oracle Internet Directory.
Oracle also fixed serious problems in other products. Oracle Commerce got 66 updates, including some that could be attacked from a distance with a CVSS score of 9.8.
Oracle E-Business Suite got 120 updates, while Oracle Database Products got 17 security fixes. Major problems were also fixed in Oracle Essbase, Enterprise Manager, Financial Services apps, and Oracle Hospitality Simphony.
Organizations should focus on WebLogic servers that are connected to the internet, especially those with T3, IIOP, or RMI services open to untrusted networks.
Security teams need to find the affected versions, get the right updates from Oracle’s Patch Availability Documents, test the updates in safe environments, and roll them out quickly when it’s workable.
Where quick fixes are not possible, admins should block access to open protocols and reduce unnecessary network reach. But Oracle warns that these workarounds do not solve the main problems.
