Oracle July CPU: 18 Critical Fusion Middleware CVEs, Four at CVSS 10.0

Oracle's July Critical Patch Update includes 18 critical Fusion Middleware flaws. Four score CVSS 10.0 and hit WebLogic, HTTP Server, Coherence, and Access Manager.

Incident Overview

On 21 July 2026 Oracle shipped the July Critical Patch Update (CPU). Oracle Fusion Middleware carries 18 critical vulnerabilities, CVSS 9.1 to 10.0. Several allow unauthenticated remote attackers full system takeover and put enterprise Java application infrastructure at serious risk.

Critical CVE List

| CVE | Component | CVSS | Attack vector |
|---|---|---|---|
| CVE-2026-60365 | Oracle HTTP Server / WebLogic Proxy Plug-in | 10.0 | HTTP, unauthenticated |
| CVE-2026-47056 | Oracle Data Integrator (REST Service) | 10.0 | HTTP, unauthenticated |
| CVE-2026-60217 | Oracle Coherence (Core) | 10.0 | TCP, unauthenticated |
| CVE-2026-60360 | Oracle Unified Directory (OUD Core) | 10.0 | HTTP, unauthenticated |
| CVE-2026-60204 | Oracle WebLogic Server (Core) | 9.8 | T3/IIOP, unauthenticated |
| CVE-2026-60363 | Oracle HTTP Server (Apache Plugin) | 9.8 | HTTP, unauthenticated |
| CVE-2026-60206 | Oracle WebLogic Server (Core) | 9.9 | network, low privilege |
| CVE-2026-60358 | Oracle Access Manager | 9.1 | HTTP, unauthenticated |

Priority Analysis

CVE-2026-60365: HTTP Server full data compromise (CVSS 10.0)

Affects Oracle HTTP Server 12.2.1.4.0, 14.1.2.0.0, and WebLogic Proxy Plug-in 15.1.1.0.0. Over HTTP an attacker can:

• Access all data without authorization
• Create, delete, or modify critical data
• Affect resources beyond the HTTP Server process itself (S:C)

Oracle HTTP Server is commonly a reverse proxy on the network edge. Internet-facing deployments are high risk.

CVE-2026-60358: Access Manager authentication bypass (CVSS 9.1)

Highest strategic risk in this CPU. Access Manager is the enterprise identity gateway for every protected app. Successful exploit can:

• Bypass authentication on all protected applications
• Enable enterprise-scale lateral movement
• Hit an internet-facing surface by design

CVE-2026-47056: Data Integrator full takeover (CVSS 10.0)

Affects the REST Service in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker can fully take over ODI over HTTP and may affect other linked products.

Impact Assessment

• Products: WebLogic Server, HTTP Server, Coherence, Data Integrator, Unified Directory, Access Manager
• Active exploitation: none confirmed yet. Fusion Middleware bugs have historically been weaponized within days of a CPU.
• EPSS: several scores are in a rising band.
• Attractiveness: unauthenticated remote takeover against enterprise targets is a high-value vector.

Remediation

Immediate (today)

• Apply the July CPU. It is the only complete fix.
• Prioritize internet-exposed systems: Oracle HTTP Server and WebLogic Server first.
• If patching slips, firewall-restrict access to Oracle services.

Short term (within 1 week)

• Inventory every Oracle Fusion Middleware product and version.
• Verify the July CPU is on every system.
• Audit Fusion Middleware configs against a security baseline.
• Increase monitoring on Oracle services.

Log monitoring

# Monitor abnormal HTTP Server access patterns
grep -E "(/weblogic/|%2e%2e)" /path/to/ohs/logs/access_log

# Monitor WebLogic AdminServer anomalies
cat /path/to/AdminServer.log | grep -i "error\|exception"

# Monitor abnormal Oracle service processes
ps aux | grep -E "(java|weblogic|httpd)"

References

• Oracle July 2026 Critical Patch Update Advisory
• ThreatAft: 18 critical CVEs explained
• Enigma Global: daily threat-intel brief