InfoSecBulletin Cybersecurity for mankind
Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection.
The vulnerability affects three Apache Tika modules and can be exploited by embedding specially designed XFA files in PDF documents.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Oracle products patched for the issue include Commerce, Communications, Construction and Engineering, Fusion Middleware, and PeopleSoft.
Oracle Communications had the most security fixes, totaling 56. Among these, 34 address vulnerabilities that remote, unauthenticated attackers could exploit. Fusion Middleware has 51 new security patches, 47 of which fix vulnerabilities that can be accessed remotely without authentication.
Financial Services Applications received 38 new fixes, with 33 for unauthenticated remote issues, while MySQL had 20 patches, including 7 for flaws exploitable by remote, unauthenticated attackers.
In October 2023, Siebel CRM, Retail Applications, and Virtualization each got 14 security patches. However, the number of remotely exploitable issues without authentication varies: 11 for Siebel CRM, 10 for Retail Applications, and 1 for Virtualization.
12 patches were released for Hyperion, addressing 10 remote vulnerabilities. PeopleSoft also received 12 patches, with 10 for security. Java SE had 11 patches, all for security issues, while Supply Chain had 10 patches, with 8 for vulnerabilities.
Over two dozen Oracle products received fewer than 10 new security fixes. The following are their counts: Construction and Engineering (8 total – 7 new), Analytics (8 total – 6 new), E-Business Suite (8 total – 2 new), Commerce (7 total – 6 new), JD Edwards (7 total – 5 new), Database Server (7 total – 2 new), HealthCare Applications (6 total – 6 new), Utilities Applications (5 total – 4 new), GoldenGate (5 total – 3 new), and Health Sciences Applications (5 total – 3 new).
Several updated products received fixes for flaws and non-exploitable bugs. Oracle also patched non-exploitable third-party CVEs for some products.
On Tuesday, Oracle announced 14 new security patches for the Oracle Solaris Operating System, with 11 addressing remotely exploitable bugs that don’t require authentication.
