ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Oracle”

206 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 487Exploit / PoC 193Ransomware 189Industry 138Malware 129Data breach 94Policy & legal 83Threat actor 54Phishing & fraud 40Advisory 33AI tools & infra 32AI research 23AI industry 19AI safety & security 10
SeverityAllcritical 772high 290medium 206low 189info 91

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber Security · 6h agoAdvisory 3 sources

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable Blog · 1d agoVulnerability

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.

Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.

Qualys ThreatPROTECT · 28d agoAdvisory2

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle's August 2026 CSPU fixes 925 CVEs across 943 patches, including 154 critical fixes; Fusion Middleware gets 262 patches.

Oracle released its August 2026 Critical Security Patch Update on August 18, addressing 925 unique CVEs with 943 security updates. 154 issues (16.3%) carry a critical severity rating. Oracle Fusion Middleware received the most patches at 262, accounting for 27.8% of the total. Oracle introduced the monthly CSPU cycle in May 2026 as an interim release between quarterly Critical Patch Updates.

Tenable Blog · 29d agoAdvisory

ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-644 for CVE-2026-60155, a race condition local privilege escalation in Oracle VirtualBox VMSVGA, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-644 describing a race condition in Oracle VirtualBox's VMSVGA component. Local attackers who already execute high-privileged code on the guest system can escalate privileges on affected installations. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60155.

ZDI Published Advisories · 7d agoAdvisory 6 sourcesCVE-2026-60155

ZDI-26-635: Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-60392, an integer overflow in Oracle Outside In PDF parsing enabling remote code execution, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-635 describing an integer overflow vulnerability in PDF file parsing within Oracle Outside In Technology. Successful exploitation allows remote code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned the flaw a CVSS rating of 7.8.

ZDI Published Advisories · 7d agoAdvisory 4 sourcesCVE-2026-603921

ZDI-26-642: Oracle VirtualBox IDisplay Out-Of-Bounds Read Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-642 for CVE-2026-60159, an out-of-bounds read local privilege escalation in Oracle VirtualBox IDisplay, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-642 describing an out-of-bounds read in Oracle VirtualBox's IDisplay component that enables local privilege escalation. Attackers must first obtain the ability to execute high-privileged code on the target guest system. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60159.

ZDI Published Advisories · 7d agoAdvisory 6 sourcesCVE-2026-60159

ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.

ZDI Published Advisories · 7d agoVulnerability 4 sourcesCVE-2026-604121

ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI disclosed CVE-2026-71114, an out-of-bounds read in Oracle VirtualBox VirtioSCSI letting privileged local guest attackers disclose sensitive information.

The Zero Day Initiative published advisory ZDI-26-641 for an out-of-bounds read vulnerability in Oracle VirtualBox's VirtioSCSI component, assigned CVE-2026-71114 with a CVSS score of 6.1. The flaw allows local attackers to disclose sensitive information on affected installations. Exploitation requires an attacker to first obtain the ability to execute high-privileged code on the target guest system.

ZDI Published Advisories · 7d agoVulnerability 6 sourcesCVE-2026-71114

ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.

ZDI Published Advisories · 7d agoVulnerability 6 sourcesCVE-2026-71116

ZDI-26-637: Oracle Outside In Technology GEM File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed an integer overflow in Oracle Outside In Technology's GEM file parsing (CVE-2026-60413) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-637, a CVSS 7.8 integer overflow in GEM file parsing within Oracle Outside In Technology. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and results in arbitrary code execution on affected installations. The flaw is tracked as CVE-2026-60413. No exploitation activity is reported.

ZDI Published Advisories · 7d agoVulnerability 4 sourcesCVE-2026-60413

ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI disclosed memory corruption in Oracle Outside In Technology's WPS file parsing (CVE-2026-60414) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-638, a CVSS 7.8 memory corruption vulnerability in WPS file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code on affected installations by convincing the target to visit a malicious page or open a malicious file, so user interaction is required. The issue is tracked as CVE-2026-60414. The advisory reports no exploitation.

ZDI Published Advisories · 7d agoVulnerability 4 sourcesCVE-2026-60414

The Oracle of Delphi Will Steal Your Credentials

Akamai honeypots reveal attackers brute-forcing RDP credentials to download and execute a previously undetected malware family named Trojan.sysscan.

Akamai's deception technology rerouted intruders into honeypots, revealing attacks that brute-force passwords for RDP credentials to access victims. Once connected, the attackers download and execute a previously undetected malware family that Akamai named Trojan.sysscan. The intrusions target exposed RDP services through opportunistic credential guessing.

Akamai Blog · 8d agoMalware in the wild