InfoSecBulletin Cybersecurity for mankind
Oracle released 337 security patches for more than 30 products in its January 2026 Critical Patch Update (CPU), targeting approximately 230 unique CVEs. Several patches fix CVE-2025-66516 (CVSS score 10/10), a serious Apache Tika vulnerability that may allow XML External Entity (XXE) injection.
The vulnerability affects three Apache Tika modules and can be exploited by embedding specially designed XFA files in PDF documents.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
Oracle products patched for the issue include Commerce, Communications, Construction and Engineering, Fusion Middleware, and PeopleSoft.
Oracle Communications had the most security fixes, totaling 56. Among these, 34 address vulnerabilities that remote, unauthenticated attackers could exploit. Fusion Middleware has 51 new security patches, 47 of which fix vulnerabilities that can be accessed remotely without authentication.
Financial Services Applications received 38 new fixes, with 33 for unauthenticated remote issues, while MySQL had 20 patches, including 7 for flaws exploitable by remote, unauthenticated attackers.
In October 2023, Siebel CRM, Retail Applications, and Virtualization each got 14 security patches. However, the number of remotely exploitable issues without authentication varies: 11 for Siebel CRM, 10 for Retail Applications, and 1 for Virtualization.
12 patches were released for Hyperion, addressing 10 remote vulnerabilities. PeopleSoft also received 12 patches, with 10 for security. Java SE had 11 patches, all for security issues, while Supply Chain had 10 patches, with 8 for vulnerabilities.
Over two dozen Oracle products received fewer than 10 new security fixes. The following are their counts: Construction and Engineering (8 total – 7 new), Analytics (8 total – 6 new), E-Business Suite (8 total – 2 new), Commerce (7 total – 6 new), JD Edwards (7 total – 5 new), Database Server (7 total – 2 new), HealthCare Applications (6 total – 6 new), Utilities Applications (5 total – 4 new), GoldenGate (5 total – 3 new), and Health Sciences Applications (5 total – 3 new).
Several updated products received fixes for flaws and non-exploitable bugs. Oracle also patched non-exploitable third-party CVEs for some products.
On Tuesday, Oracle announced 14 new security patches for the Oracle Solaris Operating System, with 11 addressing remotely exploitable bugs that don’t require authentication.
