Aiyu | Oracle July 2026 CPU: 1,449 Vulnerabilities Patched

Oracle's July 2026 Critical Patch Update (CPU) sets a new record with 1,449 security fixes across its entire product portfolio. Released on July 21, 2026, this quarterly update addresses vulnerabilities in Oracle Database, MySQL, Java SE, Fusion Middleware, E-Business Suite, PeopleSoft, and dozens of other product families. For developers and DBAs managing Oracle workloads, this is the largest patch cycle in recent memory — and skipping it is not an option.

Why This Matters to Developers

Oracle's quarterly CPUs are cumulative, but each advisory only documents new patches since the last release. The July 2026 CPU touches 1,449 distinct vulnerabilities — many of which are remotely exploitable without authentication. If your applications run on Oracle Database, WebLogic, Java, or any of the 300+ affected products, you are exposed until you apply these patches.

The sheer volume creates a practical problem: testing 1,449 fixes across dev, staging, and production takes time most teams don't have. But the risk of delay is concrete. Oracle explicitly warns that attackers are actively exploiting vulnerabilities for which patches already exist, simply because organizations haven't applied them.

Vulnerability Highlights: The Critical Few

While 1,449 CVEs is overwhelming, a handful stand out for developers:

Oracle Database Server — 15 New Patches (6 Remotely Exploitable Without Auth)

CVE	Component	CVSS 3.1	Vector	Key Detail
CVE-2026-61211	RDBMS (DBMS_CLOUD)	9.9	Network/Low/Low/None/Changed/H/H/H	Execute DBMS_CLOUD → RCE
CVE-2026-47040	Oracle Net Services	9.1	Network/Low/None/None/Unchanged/H/None/H	Connection Manager flaw
CVE-2026-4738	Spatial & Graph (GDAL)	8.8	Network/Low/Low/None/Unchanged/H/H/H	HTTPS vector
CVE-2026-60175	RDBMS (Authenticated)	8.8	Network/Low/Low/None/Unchanged/H/H/H	Requires valid creds

CVE-2026-61211 is the standout: a CVSS 9.9 in DBMS_CLOUD that allows unauthenticated remote code execution over Oracle Net. Any internet-facing Oracle Database with cloud features enabled is a target.

MySQL — Multiple Critical Fixes

MySQL Server 8.4.0–8.4.10, 9.0.0–9.7.1, and MySQL Router/Connectors all receive patches. Several CVEs affect the replication and clustering components developers rely on for HA setups.

Java SE — 7 Updates Across JDK 8, 11, 17, 21, 25, 26

Oracle Java SE updates address vulnerabilities in core libraries (OpenSSL, Jakarta Mail, Jackson). If you bundle a JRE with your application, rebuild with the patched versions (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1).

Fusion Middleware — WebLogic, Coherence, SOA Suite, BI

WebLogic Server 12.2.1.4.0 and 14.1.1.0.0/14.1.2.0.0/15.1.1.0.0 receive fixes for deserialization and RCE vectors. Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 patches address cluster membership flaws.

Affected Systems: Who Needs to Act

Short answer: Everyone running Oracle software on supported versions.

Oracle Database: 19c (19.3–19.31), 21c (21.3–21.22), 23c (23.4.0–23.26.2)
MySQL: 8.0.0–8.0.47, 8.4.0–8.4.10, 9.0.0–9.7.1
Java SE: All current LTS and feature releases
Fusion Middleware: WebLogic, Coherence, SOA Suite, BI, Identity Manager, HTTP Server
E-Business Suite: 12.2.3–12.2.15, V16
PeopleSoft: PeopleTools 8.61, 8.62 + all application modules
JD Edwards: Tools 9.2.26.3 + application modules
Oracle Communications, Retail, Utilities, Hospitality, Financial Services — dozens of industry-specific products

Unsupported versions (e.g., Database 12.2, 18c; Java 6, 7) receive no patches. Oracle strongly recommends upgrading to supported releases.

Mitigation & Patching: Step-by-Step

1. Inventory Your Oracle Footprint

Before patching, know what you're running:

bash

Cross-reference each component against the Oracle CPU July 2026 Patch Availability Document (requires My Oracle Support login).

2. Prioritize by Exposure

Not all 1,449 patches apply to your environment. Filter by:

Internet-facing systems first: Database listeners, WebLogic admin consoles, Java web apps
Authentication-bypass CVEs (CVSS ≥ 9.0): CVE-2026-61211, CVE-2026-47040, CVE-2026-47046
Components you actually use: Don't patch GoldenGate if you don't run it

3. Apply Patches in Staged Order

Oracle recommends this sequence to minimize dependency conflicts:

OPatch / OPatchAuto — update the patching tool itself first
Database homes — apply DB patches (includes DBMS_CLOUD fix)
Grid Infrastructure — if using RAC/ASM
Middleware homes — WebLogic, Coherence, BI, etc.
Java homes — JDK/JRE updates
Application tiers — EBS, PeopleSoft, JD Edwards

Use opatchauto apply -analyze for a dry-run before committing.

4. Test Thoroughly — But Quickly

The CPU is cumulative. Regression risk is real but manageable:

Run your automated test suite against a patched staging clone
Focus on: database connectivity, PL/SQL packages using DBMS_CLOUD, WebLogic deployments, Java app startup
For zero-downtime requirements, use Data Guard rolling apply or Fleet Patching and Provisioning

5. Workarounds If You Cannot Patch Immediately

Oracle documents network-level mitigations for the highest-risk CVEs:

CVE	Workaround
CVE-2026-61211	Revoke `EXECUTE` on `DBMS_CLOUD` from non-admin users; block Oracle Net at firewall for non-trusted networks
CVE-2026-47040	Disable Oracle Connection Manager if not used; restrict listener to trusted IPs
CVE-2026-47046	Network segmentation: isolate Database tier from application tier

These are temporary. Patching remains the only complete fix.

Detection: How to Know If You're Compromised

Database-Level Indicators

sql

Network-Level Detection

Suricata rule for Oracle Net anomalous traffic:

alert tcp any any -> $ORACLE_SERVERS 1521 (msg:"ET EXPLOIT Oracle DBMS_CLOUD RCE Attempt"; flow:to_server; content:"DBMS_CLOUD"; nocase; sid:2026001; rev:1;)

Zeek/Bro script to log all TNS handshake attempts with payload inspection

Log Sources to Monitor

Oracle Database audit trail (AUD$, UNIFIED_AUDIT_TRAIL)
WebLogic access logs (access.log) for deserialization attempts
Java application GC logs for unexpected native library loads
Firewall/IDS alerts for outbound connections from DB servers

Frequently Asked Questions

Q: Do I need to apply all 1,449 patches?

Only the patches for products and versions you actually run. Use the Patch Availability Document to generate a targeted list.

Q: Can I skip this CPU and catch up in October?

No. Actively exploited vulnerabilities (including CVE-2026-61211-class issues) are being weaponized now. Oracle's own advisory states attackers succeed because "customers had failed to apply available Oracle patches."

Q: What about Oracle Cloud (OCI, Autonomous Database)?

Oracle manages patching for Autonomous Database and OCI managed services. Check the OCI Console for maintenance notifications — but verify your custom PDBs and bring-your-own-license workloads.

Q: Are there any CVEs with no patch yet?

The CPU covers all vulnerabilities Oracle has fixed this quarter. Third-party components (OpenSSL, Apache Tomcat, Jackson, etc.) may have newer upstream fixes not yet bundled — check component release notes.

Q: How long does a typical CPU apply take?

Single-instance Database: 30–90 minutes downtime
RAC (rolling): 2–4 hours per node, no full outage
WebLogic domain: 15–30 minutes per managed server
Full EBS/PeopleSoft: 4–8 hours depending on customizations

Plan a maintenance window accordingly.

Key Takeaways

1,449 vulnerabilities — largest Oracle CPU on record
CVE-2026-61211 (CVSS 9.9) in DBMS_CLOUD enables unauthenticated RCE — patch Database first
6 Database CVEs remotely exploitable without auth — prioritize internet-facing listeners
Java SE, MySQL, WebLogic, Coherence all have critical fixes
Unsupported versions get nothing — upgrade or accept risk
Test in staging, but don't delay — active exploitation is confirmed

Conclusion

Oracle's July 2026 CPU is a patching marathon, not a sprint. The volume is unprecedented, but the process hasn't changed: inventory, prioritize, test, deploy. Automate where you can (Fleet Patching and Provisioning, Ansible, Terraform), and treat the highest-CVSS Database and Middleware fixes as emergencies. The cost of a weekend patch cycle is trivial compared to a breach.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

Oracle July 2026 Critical Patch Update: 1,449 Vulnerabilities Patched