ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Oracle Access Manager”

9 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 171Ransomware 84Exploit / PoC 64Malware 52Data breach 49Industry 38Policy & legal 35Threat actor 17AI tools & infra 14Phishing & fraud 11AI research 10Advisory 9AI industry 7Tools 5
SeverityAllcritical 309high 118medium 57low 52info 36

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber Security · 4h agoAdvisory 3 sources

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity Magazine · 9h agoAdvisory