/DISPATCH · 2026-08-29

Oracle August CPU: Public PoCs Hit MySQL, Java, WebLogic — Unauth RCE / Data Tampering

GovCERT.HK issued high-severity alert A26-08-28: PoC code for at least eight Oracle August CPU CVEs is public, including CVE-2026-2332, CVE-2026-9563, CVE-2026-41240, CVE-2026-42587, CVE-2026-65914. Affected products: Java SE, Database, Fusion Applications, Middleware, MySQL suite, Linux, virtualization. Successful exploitation: RCE, DoS, privilege escalation, information disclosure, restriction bypass, spoofing, or tampering.

Incident Overview

GovCERT.HK issued high-severity alert A26-08-28 on 19 August 2026: at least eight CVEs in Oracle's August Critical Patch Update (CPU) now have public proof-of-concept (PoC) code. Exploitation can yield remote code execution, denial of service, privilege escalation, information disclosure, security-restriction bypass, spoofing, or data tampering. Affected products: Oracle Java SE, Oracle Database, Oracle Fusion Applications and Middleware (e.g. WebLogic), the MySQL product suite, Oracle Linux and virtualization. Oracle published the full patch list the same day. Java SE moved to 8u503 / 11.0.32.1 / 17.0.20.1 / 21.0.12.1 / 25.0.4.1 / 26.0.2.1.

GovCERT.HK named PoC-public IDs: CVE-2022-37434, CVE-2022-40152, CVE-2023-50164, CVE-2026-2332, CVE-2026-9563, CVE-2026-41240, CVE-2026-42587, CVE-2026-65914. Attackers already have working exploit code. Scan-and-weaponize window is extremely short.

Key Technical Details

NCSC-NL CSAF (CVE-2026-65914): multiple vulns in MySQL Cluster 8.0.0–8.0.48, 8.4.0–8.4.11, 9.7.0–9.7.2. Unauthenticated network attackers can trigger DoS, unauthorized data modification, and under some conditions full takeover. Connector/ODBC 26.7.0 has multiple defects: process crash plus partial data leak.

CVE-2026-2332 / CVE-2026-9563 / CVE-2026-41240 / CVE-2026-42587 / CVE-2026-65914: MySQL product line. Availability and data integrity. Some need only low prior privileges;
CVE-2022-37434 / CVE-2022-40152 / CVE-2023-50164: deserialization and request smuggling in Oracle Fusion Middleware. Attackers bypass auth and hit admin interfaces directly;
CWE mix: CWE-79 (XSS), CWE-120 (classic buffer overflow), CWE-426 (untrusted search path), CWE-427 (uncontrolled search path element), CWE-476 (NULL pointer dereference), CWE-787 (out-of-bounds write).

Impact Scope

Oracle Java SE: all JDK/JRE versions before 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2.1;
Oracle Database: Fusion Applications DB backends, Oracle RAC, WebLogic companion DB stacks;
Oracle MySQL: MySQL Server, MySQL Cluster (8.0/8.4/9.7), MySQL Connector/ODBC 26.7.0;
Oracle Fusion Middleware: WebLogic Server, TopLink, Coherence, etc.;
Oracle Linux and Virtualization: Ksplice kernel live-patch packages and virtualization layer;
MySQL and WebLogic sit in many cloud business systems. Financial services, telecom, and government in Southeast and East Asia: highest risk rating.

Remediation

Patch by business line: Java to 8u503 / 11.0.32.1 / 17.0.20.1 / 21.0.12.1 / 25.0.4.1 / 26.0.2.1; MySQL to 8.0.48+ / 8.4.11+ / 9.7.2+; WebLogic per 14.1.2.0+ CPU packages;
Validate patch compatibility on production clones first, especially coupling with OEM Grid Control, GoldenGate, Data Guard;
Until patched, lock externally exposed WebLogic admin consoles and MySQL 3306/33060 to minimum trusted source IPs;
Audit listener.log and SQL audit tables: --prepared_statement, anomalous plugin loads, unauthorized JDBC calls;
WAF/IPS signatures: block SOAP deserialization payloads tied to CVE-2022-40152; block malformed Connector/ODBC packets for CVE-2026-65914;
Keep a ledger of PoC-public vulns. Track in SLO: CVE-2026-65914, CVE-2026-65914, CVE-2026-42587, CVE-2026-41240, CVE-2026-9563, CVE-2026-2332.

References

GovCERT.HK A26-08-28 Chinese alert
GovCERT.HK English original (Enigma Global archive)
Oracle CPU August 2026 official advisory
NCSC-NL CSAF: CVE-2026-65914 detailed analysis
HKCERT security bulletin: multiple vulnerabilities in Oracle products