ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Oracle Access Manager”

118 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 171Ransomware 84Exploit / PoC 64Malware 52Data breach 49Industry 38Policy & legal 35Threat actor 17Phishing & fraud 11Advisory 9Tools 5
SeverityAllcritical 309high 118medium 54low 52info 2

Oracle’s September patches put Fusion Middleware back in the hot seat

Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.

Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.

CSO Online · 13h agoVulnerabilityCVE-2026-71133CVE-2026-83099CVE-2026-83059+16 CVEs

U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog

CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.

CISA added CVE-2026-60004, a critical remote code execution flaw in Gitea (CVSS 9.8), to its Known Exploited Vulnerabilities catalog. The flaw affects Gitea versions since 1.17, fixed in 1.27.1, and lets attackers with repository write access execute shell commands via the diffpatch API and Git hooks. Open registration allows unauthenticated attackers to create accounts and exploit exposed instances, with a reported attack deploying a cryptocurrency-miner-like payload.

Security Affairs · 21d agoExploit / PoC in the wildCVE-2026-60004

McKesson copes with fallout from data theft extortion attack

McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.

McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.

CyberScoop · 16d agoData breach in the wild