/00 — boot sequence

Hello.

aiyu
← Back to Blogs

Article

Oracle July 2026 CPU: 1,449 Vulnerabilities Patched Including Critical RCE Flaws

July 28, 2026•6 min read
security oracle cpu patch-tuesday database rce

Oracle released its July 2026 Critical Patch Update (CPU) on July 21, addressing 1,449 new security vulnerabilities across the entire Oracle product portfolio. This is one of the largest quarterly CPUs in recent years, spanning Database, Fusion Middleware, MySQL, Java, E-Business Suite, PeopleSoft, JD Edwards, Oracle Communications, and more.

The CPU includes patches for vulnerabilities with CVSS scores up to 9.9 (Critical), including remotely exploitable flaws requiring no authentication. Organizations running any Oracle software should prioritize applying these updates immediately.

Vulnerability Overview

Key Statistics:

  • 1,449 new security patches
  • 72 patches for Oracle Database products alone
  • 15 new Oracle Database Server vulnerabilities (6 remotely exploitable without auth)
  • 27 Oracle GoldenGate patches
  • Multiple Critical CVSS 9.0+ vulnerabilities across product families

Highest-Profile Fixes:

CVEProductCVSSAttack VectorNotes
CVE-2026-61211Oracle Database (RDBMS)9.9NetworkExecute DBMS_CLOUD, no auth required
CVE-2026-47040Oracle Net Services9.1NetworkConnection Manager, no auth required
CVE-2026-4738Spatial and Graph (gdal)8.8NetworkHTTPS, no auth required
CVE-2026-60175Oracle Database (RDBMS)8.8NetworkAuthenticated user, no auth required
CVE-2026-47046Oracle Database (RDBMS)8.2NetworkNo auth required
CVE-2026-7383Database (OpenSSL)8.1NetworkTLS, no auth required
CVE-2026-54518Fleet Patching (jackson-databind)7.5NetworkNo auth required

Affected Product Families (Partial)

The CPU covers vulnerabilities in these major product lines:

Database & Core Technology:

  • Oracle Database Server (19c, 21c, 23c)
  • Oracle APEX (24.1, 24.2, 26.1)
  • Oracle GoldenGate (19c, 21c, 23c)
  • Oracle Autonomous Health Framework
  • Oracle Essbase
  • Oracle SQL Developer
  • Oracle TimesTen In-Memory Database
  • Oracle NoSQL Database

Middleware & Applications:

  • Oracle WebLogic Server (12.2.1.4, 14.1.1, 14.1.2, 15.1.1)
  • Oracle Fusion Middleware
  • Oracle SOA Suite
  • Oracle Business Process Management
  • Oracle HTTP Server
  • Oracle Coherence
  • Oracle Identity Manager
  • Oracle Access Manager
  • Oracle Unified Directory

Java & Development:

  • Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1)
  • Oracle GraalVM Enterprise Edition
  • Oracle GraalVM for JDK
  • Oracle JDeveloper

Applications Suites:

  • Oracle E-Business Suite (12.2, V16)
  • PeopleSoft Enterprise (PeopleTools 8.61, 8.62)
  • JD Edwards EnterpriseOne (Tools 9.2.26.3)
  • Oracle Retail Applications
  • Oracle Financial Services
  • Oracle Healthcare Applications
  • Oracle Hospitality (Simphony, Cruise, SPMS)

Communications & Engineering:

  • Oracle Communications Billing & Revenue Management
  • Oracle Communications Session Border Controller
  • Oracle Communications Diameter Signaling Router
  • Oracle Communications Network Analytics
  • Primavera P6 EPPM
  • Oracle Utilities Applications

Systems & Virtualization:

  • Oracle Solaris (11.3, 11.4)
  • Oracle VM VirtualBox (7.2.8, 7.2.12)
  • Oracle Linux (via Unbreakable Enterprise Kernel)

Critical Database Vulnerabilities Deep Dive

CVE-2026-61211: RDBMS DBMS_CLOUD Execution (CVSS 9.9)

  • Component: RDBMS
  • Privilege Required: Execute DBMS_CLOUD
  • Protocol: Oracle Net
  • Remote Exploit Without Auth: No
  • Affected: 19.3-19.31, 23.4.0-23.26.2
  • Impact: Full CIA (Confidentiality, Integrity, Availability) = High

This is the highest-scoring database vulnerability. An attacker with DBMS_CLOUD execute privilege can achieve full database compromise.

CVE-2026-47040: Oracle Net Services Connection Manager (CVSS 9.1)

  • Component: Oracle Net Services
  • Privilege Required: Connection Manager
  • Protocol: Oracle Net
  • Remote Exploit Without Auth: Yes
  • Affected: 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2

A critical unauthenticated remote vulnerability in the Connection Manager component.

CVE-2026-4738: Spatial and Graph GDAL (CVSS 8.8)

  • Component: Oracle Spatial and Graph (gdal)
  • Privilege Required: None
  • Protocol: HTTPS
  • Remote Exploit Without Auth: No
  • Affected: 19.3-19.31, 23.4.0-23.26.2

CVE-2026-60175: RDBMS Authenticated User (CVSS 8.8)

  • Component: RDBMS
  • Privilege Required: Authenticated User
  • Protocol: Oracle Net
  • Remote Exploit Without Auth: No
  • Affected: 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2

MySQL Vulnerabilities

The CPU includes patches for MySQL Server, Cluster, Connectors, and Router:

  • MySQL Server 8.4.0-8.4.10, 9.0.0-9.7.1: Multiple CVEs including CVE-2026-47045 (JDBC, CVSS 6.8), CVE-2026-47060 (JDBC, CVSS 6.5)
  • MySQL Router 8.4.0-8.4.10, 9.7.0-9.7.1: Patched
  • MySQL Connectors 9.7.0-9.7.1: Patched

Java SE Critical Patches

Oracle Java SE receives updates for versions 8, 11, 17, 21, 25, 26. Notable:

  • CVE-2026-7383 (OpenSSL, CVSS 8.1) - affects JDK 23.4.0-23.26.2
  • Multiple third-party component updates (Jackson, Jakarta Mail, etc.)

Mitigation & Patching Strategy

1. Prioritize by Exposure:

  • Internet-facing Oracle services → Patch immediately
  • Database listeners exposed to untrusted networks → Patch immediately
  • Internal-only systems with defense-in-depth → Patch within maintenance window

2. Apply Cumulative Patches: Oracle CPUs are cumulative. Applying the latest CPU includes all prior fixes. However, if you've skipped CPUs, review prior advisories for any non-cumulative patches.

3. Use Oracle's Patch Availability Documents: Each product family has a "Patch Availability Document" linked from the CPU advisory. These provide exact patch numbers, download links, and installation instructions.

4. Test Before Production:

  • Apply patches in dev/test first
  • Validate application compatibility
  • Check for known issues in the CPU's "Modification History" section

5. Workarounds (if immediate patching impossible):

  • Restrict network access to Oracle listeners (port 1521, 2484, etc.)
  • Disable unused components (APEX, GoldenGate, Spatial, etc.)
  • Remove excessive privileges (DBMS_CLOUD, CREATE SESSION for unused accounts)
  • Monitor for exploitation attempts via audit logs and network IDS

Detection Rules

Suricata: Oracle TNS Listener Exploitation Attempts

alert tcp any any -> $ORACLE_SERVERS 1521 (msg:"ORACLE TNS Potential Exploit CVE-2026-47040"; flow:to_server,established; content:"|00 00 00|"; offset:0; depth:3; content:"|00 00 00 00 00 00 00 00|"; distance:0; within:8; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-admin; sid:202647040; rev:1;)

YARA: Oracle CPU July 2026 Exploit Indicators

yara

Sigma: Suspicious Oracle Database Activity

title: Suspicious Oracle DBMS_CLOUD Execution id: 20260728-oracle-dbms-cloud-exploit status: experimental description: Detects potential exploitation of CVE-2026-61211 via DBMS_CLOUD logsource: category: database product: oracle detection: selection: sql_text|contains: "DBMS_CLOUD" condition: selection fields: - sql_text - username - client_ip - timestamp level: high tags: - attack.execution - attack.t1059

Frequently Asked Questions

Q: Are the patches cumulative? A: Yes, CPUs are cumulative. Applying the July 2026 CPU includes all fixes from prior CPUs. However, if you skipped a prior Critical Patch Update, verify no interim patches were required.

Q: Does this affect Oracle Cloud Infrastructure (OCI) managed services? A: Oracle applies patches to managed services (Autonomous Database, OCI MySQL, etc.) on their maintenance schedule. Check the OCI maintenance notifications for your region.

Q: What about third-party components like OpenSSL, Jackson? A: The CPU includes updated third-party libraries. The vulnerability descriptions note which CVEs are addressed via component upgrades (e.g., CVE-2026-7383 via OpenSSL update).

Q: Can I just patch the database and skip middleware? A: Only if you don't use the middleware components. Each product family is independently vulnerable. Inventory your Oracle estate and patch everything you run.

Q: Are there any zero-days in this CPU? A: Oracle does not disclose whether vulnerabilities were exploited in the wild before the CPU release. The CVSS scores and "Remote Exploit Without Auth" flags indicate theoretical exploitability. Assume attackers will reverse-engineer patches quickly.

Q: What's the timeline for the next CPU? A: Oracle CPUs release quarterly: October 20, 2026 (next CPU), January 2027, April 2027, July 2027.

Key Takeaways

  • 1,449 vulnerabilities is a massive patching burden. Automate where possible.
  • Database listeners are the highest-risk attack surface. Restrict network access aggressively.
  • CVE-2026-61211 (CVSS 9.9) and CVE-2026-47040 (CVSS 9.1) are the crown jewels for attackers—patch Database and Net Services first.
  • Third-party component updates (OpenSSL, Jackson, GDAL) mean even "non-Oracle" code paths are fixed.
  • Java SE updates affect every Java application on Oracle JDK. Don't forget app servers, build agents, developer workstations.
  • Test thoroughly: A 1,449-patch CPU has high regression risk. Staged rollout is essential.

Conclusion

The Oracle July 2026 CPU is a landmark release by volume and severity. With 1,449 fixes including multiple CVSS 9.0+ remotely exploitable vulnerabilities, this is not a routine maintenance event—it's a critical security milestone. Organizations should enact emergency patching procedures for internet-facing and business-critical Oracle systems, then schedule comprehensive patching for all remaining Oracle assets within their standard maintenance windows. The risk of delay is measured in potential full-system compromise via unauthenticated network attacks.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Resources & Links