← News
/DISPATCH · 2026-08-21

Oracle August Critical Patch Update Fixes 943 Vulnerabilities: Multiple WebLogic CVSS 9.8; Oracle Internet Directory Scores 10.0

Oracle's quarterly Critical Patch Update on August 19 patched 943 vulnerabilities across 23 product lines. Focus: CVE-2026-61241 in the LDAP component, CVSS 10.0 unauthenticated RCE, and multiple WebLogic Server T3/IIOP remote code execution bugs at CVSS 9.8/9.9. Complete production patching within 72 hours.

Oracle published its quarterly Critical Patch Update (CPU) on August 19, 2026, fixing 943 vulnerabilities across 23 product families—about 4x the June CPU. Two primary tracks: Oracle Internet Directory LDAP component CVE-2026-61241, CVSS v3.1 10.0 unauthenticated RCE, and multiple WebLogic Server T3 and IIOP remote code execution bugs at CVSS 9.8/9.9. Fusion Middleware and Hyperion each received 262 patches. Of those, 182 Fusion Middleware and 107 Hyperion bugs are remotely exploitable without authentication.

Incident Overview

This CPU is Oracle's largest quarterly update to date, aimed at enterprise back-end infrastructure. Oracle states it has not observed in-the-wild exploitation, which does not justify waiting for the next cycle. Combined 10.0 and 9.8 ratings mean an attacker who finds one Oracle Fusion Middleware instance on a public network has a complete intrusion path.

Core CVE list:

Technical Details

Oracle Internet Directory (OID) is the identity hub for WebLogic, SOA Suite, and Fusion Middleware. Compromise of an OID instance exposes every dependent app to lateral movement and privilege escalation. OID compromise equals identity-infrastructure breach. CVE-2026-61241 is in LDAP Server search-request handling. A malformed LDAP filter triggers memory corruption and arbitrary code execution on the OID server.

The WebLogic cluster is repeated T3 and IIOP exposure. T3 is WebLogic's proprietary RMI protocol; IIOP is CORBA. Both have a history of unauthenticated RCE: CVE-2020-2551 (IIOP, CVSS 9.8, in-the-wild), CVE-2024-21216 (T3+IIOP, CVSS 9.8, APT use), CVE-2025-21535 (T3+IIOP, CVSS 9.8, disclosed in January). CVE-2026-60698 / 60672 / 60696 / 60977 form a same-origin attack surface and follow the same patch / reverse-engineer / PoC cadence—Oracle patches, researchers diff, public PoC within days. If port 7001 is reachable from an untrusted network, current CVE identity is secondary; the risk is present.

182 remotely unauthenticated Fusion Middleware bugs and 107 Hyperion equivalents reflect Oracle's AI-assisted vuln scanning catching a large historical backlog. This is not 1,000 new bugs in a week; it is accumulated debt released at once. That release cadence stresses customer security ops. Traditional Patch Tuesday assumes a few CVEs per component per month. This CPU dumps 262 patches on one Fusion Middleware component.

Impact Assessment

From an attacker view, three high-value scenarios:

Tenable and other research orgs rank patch priority: internet-facing Fusion Middleware > Oracle Internet Directory > WebLogic Server > Hyperion. Practical window is 72 hours. Fusion Middleware past that window should be treated as high-risk.

Remediation

Oracle is explicit: no compensating control fully remediates these bugs. Patch.

CPU scale and concentration imply security-ops cadence must compress from monthly Patch Tuesday toward weekly. Under AI-assisted vuln scanning, Oracle's next large dump may land in the October CPU. Build automated ticketing and rollback for Fusion Middleware, WebLogic, and OID now, or the next concentrated release will hit passively.

References