InfoSecBulletin Cybersecurity for mankind
Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection.
The vulnerability affects three Apache Tika modules and can be exploited by embedding specially designed XFA files in PDF documents.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Oracle products patched for the issue include Commerce, Communications, Construction and Engineering, Fusion Middleware, and PeopleSoft.
Oracle Communications had the most security fixes, totaling 56. Among these, 34 address vulnerabilities that remote, unauthenticated attackers could exploit. Fusion Middleware has 51 new security patches, 47 of which fix vulnerabilities that can be accessed remotely without authentication.
Financial Services Applications received 38 new fixes, with 33 for unauthenticated remote issues, while MySQL had 20 patches, including 7 for flaws exploitable by remote, unauthenticated attackers.
In October 2023, Siebel CRM, Retail Applications, and Virtualization each got 14 security patches. However, the number of remotely exploitable issues without authentication varies: 11 for Siebel CRM, 10 for Retail Applications, and 1 for Virtualization.
12 patches were released for Hyperion, addressing 10 remote vulnerabilities. PeopleSoft also received 12 patches, with 10 for security. Java SE had 11 patches, all for security issues, while Supply Chain had 10 patches, with 8 for vulnerabilities.
Over two dozen Oracle products received fewer than 10 new security fixes. The following are their counts: Construction and Engineering (8 total – 7 new), Analytics (8 total – 6 new), E-Business Suite (8 total – 2 new), Commerce (7 total – 6 new), JD Edwards (7 total – 5 new), Database Server (7 total – 2 new), HealthCare Applications (6 total – 6 new), Utilities Applications (5 total – 4 new), GoldenGate (5 total – 3 new), and Health Sciences Applications (5 total – 3 new).
Several updated products received fixes for flaws and non-exploitable bugs. Oracle also patched non-exploitable third-party CVEs for some products.
On Tuesday, Oracle announced 14 new security patches for the Oracle Solaris Operating System, with 11 addressing remotely exploitable bugs that don’t require authentication.
