Search: “Oracle Fusion Middleware”

57 stories

Security AffairsNov 22, 10:34 UTC · Nov 22, 2025Exploit / PoC in the wildCVE-2025-61757

CISA adds Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities Catalog

Security AffairsDec 16, 08:46 UTC · Dec 16, 2022Exploit / PoC in the wildCVE-2021-35587

Oracle Fusion Middleware Vulnerability Actively Exploited in the Wild: CISA

Infosecurity MagazineNov 29, 18:12 UTC · Nov 29, 2022Exploit / PoC in the wildCVE-2021-35587 CVE-2022-4135

Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587)

Help Net SecurityNov 29, 00:00 UTC · Nov 29, 2022Exploit / PoC in the wildCVE-2021-35587

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The Hacker NewsNov 29, 08:07 UTC · Nov 29, 2022Vulnerability in the wildCVE-2021-35587 CVE-2022-4135

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.

Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.

Qualys ThreatPROTECTAug 19, 13:49 UTC · 27d agoAdvisory2

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable BlogSep 15, 21:00 UTC · 14h agoVulnerability

U.S. CISA adds Microsoft Windows, Apache HugeGraph-Server, Oracle JDeveloper, Oracle WebLogic Server, and Microsoft SQL Server bugs to its Known Exploited Vulnerabilities catalog

Security AffairsSep 19, 15:48 UTC · Sep 19, 2024Exploit / PoC in the wildCVE-2024-27348 CVE-2020-0618 CVE-2019-1069+2 CVEs

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle's August 2026 CSPU fixes 925 CVEs across 943 patches, including 154 critical fixes; Fusion Middleware gets 262 patches.

Oracle released its August 2026 Critical Security Patch Update on August 18, addressing 925 unique CVEs with 943 security updates. 154 issues (16.3%) carry a critical severity rating. Oracle Fusion Middleware received the most patches at 262, accounting for 27.8% of the total. Oracle introduced the monthly CSPU cycle in May 2026 as an interim release between quarterly Critical Patch Updates.

Tenable BlogAug 19, 00:41 UTC · 28d agoAdvisory

Researchers flag new Oracle WebLogic zero-day RCE flaw

Help Net SecurityApr 25, 00:00 UTC · Apr 25, 2019Exploit / PoC in the wildCVE-2019-2725

Oracle releases emergency Oracle Identity Manager patch

Help Net SecurityOct 31, 00:00 UTC · Oct 31, 2017Vulnerability in the wildCVE-2017-10151

Oracle CPU October 2018: 301 vulnerabilities patched

Help Net SecurityOct 17, 00:00 UTC · Oct 17, 2018Vulnerability CVE-2018-2913

Massive Oracle Critical Patch Update fixes 270 vulnerabilities

Help Net SecurityMay 28, 10:21 UTC · May 28, 2020Vulnerability

Oracle issues an emergency patch for a bug in Oracle Identity Manager, apply it now!

Security AffairsNov 1, 10:07 UTC · Nov 1, 2017Vulnerability CVE-2017-10151

⚡ Weekly Recap: VPN Exploits, Oracle's Silent Breach, ClickFix Surge and More

The Hacker NewsMay 6, 07:05 UTC · May 6, 2025Data breach CVE-2025-22457 CVE-2025-24061 CVE-2025-2407+15 CVEs

Oracle confirms the hack of two obsolete servers hacked. No Oracle Cloud systems or customer data were affected

Security AffairsApr 10, 09:40 UTC · Apr 10, 2025Data breach

Oracle privately notifies Cloud data breach to customers

Security AffairsApr 6, 20:33 UTC · Apr 6, 2025Data breach

Highly Critical Flaw (CVSS Score 10) Lets Hackers Hijack Oracle Identity Manager

The Hacker NewsOct 31, 08:01 UTC · Oct 31, 2017Vulnerability CVE-2017-10151

NSA details top 25 flaws exploited by China

Security AffairsOct 20, 19:28 UTC · Oct 20, 2020Exploit / PoC CVE-2019-11510 CVE-2020-5902 CVE-2019-19781+22 CVEs

Week in review: Log4Shell lingers, NIS2 directive adopted, LastPass breached (again)

Help Net SecurityDec 4, 00:00 UTC · Dec 4, 2022Data breach in the wildCVE-2021-35587

Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability

The Hacker NewsMar 28, 06:59 UTC · Mar 28, 2022Vulnerability in the wildCVE-2022-0543 CVE-2017-10271 CVE-2018-7600+3 CVEs

Threat Source newsletter (April 21, 2022) — Sideloading apps is as safe as you make it

Cisco TalosApr 21, 18:00 UTC · Apr 21, 2022Vulnerability

CISA adds Oracle WebLogic Server flaw to its Known Exploited Vulnerabilities catalog

Security AffairsJun 3, 18:29 UTC · Jun 3, 2024Exploit / PoC in the wildCVE-2017-3506

More than 150 Oracle Access Management systems exposed to bug highlighted by CISA

The RecordJan 9, 00:00 UTC · Jan 9, 2023Exploit / PoC in the wildCVE-2021-35587

CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager

Infosecurity MagazineNov 24, 11:07 UTC · Nov 24, 2025Vulnerability in the wildCVE-2025-61757 CVE-2021-35587

8220 gang exploits old Oracle WebLogic vulnerability to deliver infostealers, cryptominers

Help Net SecurityDec 20, 00:00 UTC · Dec 20, 2023Vulnerability CVE-2020-14883 CVE-2017-3506 CVE-2020-14882

Crypto flaw in Oracle Access Manager can let attackers pass through

Help Net SecurityMay 3, 00:00 UTC · May 3, 2018Vulnerability CVE-2018-2879

Oracle botches CVE-2018-2628 patch and hackers promptly start scanning for vulnerable WebLogic installs

Security AffairsApr 30, 10:05 UTC · Apr 30, 2018Vulnerability CVE-2018-2628

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)

Help Net SecurityMar 23, 00:00 UTC · Mar 23, 2026Vulnerability in the wildCVE-2026-21992 CVE-2025-61757

Oracle fixes critical RCE flaw CVE-2026

Security AffairsMar 22, 15:37 UTC · Mar 22, 2026Vulnerability in the wildCVE-2026-21992 CVE-2025-61757

CVE-2018-2879 - Vulnerability in Oracle Access Manager can let attackers impersonate any user account

Security AffairsMay 3, 13:46 UTC · May 3, 2018Vulnerability CVE-2018-2879

ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

The Hacker NewsNov 21, 06:45 UTC · Nov 21, 2025Malware CVE-2025-61757 CVE-2025-11243

CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero

The Hacker NewsNov 22, 14:50 UTC · Nov 22, 2025Advisory in the wildCVE-2025-61757

Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2

CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.

Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.

Canadian Centre for Cyber SecurityAug 24, 18:42 UTC · 22d agoExploit / PoC in the wildCVE-2026-21962