Oracle August 2026 Patch Update: Critical WebLogic Vulnerabilities Allow Full Server Takeover
Oracle's August 2026 Critical Security Patch Update addresses 943 vulnerabilities, with a focus on critical flaws in WebLogic Server that could grant unauthenticated remote attackers full control.
Oracle has issued its August 2026 Critical Security Patch Update, rolling out a substantial 943 security patches across its extensive enterprise software portfolio. This release tackles vulnerabilities in a wide array of products, including Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, PeopleSoft, and various Communications products. The company is strongly urging customers to apply these updates immediately, citing a history of exploitation of known vulnerabilities when organizations delay patching.
The most pressing fixes are targeted at Oracle WebLogic Server, a widely adopted application server critical for hosting business applications in large organizations. The update addresses multiple remotely exploitable flaws, several carrying a CVSS severity score of 9.8 out of 10. These include CVE-2026-60698, CVE-2026-60672, and CVE-2026-60696, all impacting the WebLogic Server Core component and exploitable via the IIOP and T3 protocols. The severity of these vulnerabilities stems from their remote, unauthenticated nature, posing significant risks to confidentiality, integrity, and availability, potentially allowing attackers to execute unauthorized actions, steal data, or gain complete control of vulnerable environments.
Further compounding the risk for WebLogic Server users, the update also patches CVE-2026-60977, a critical RMI-related flaw with a CVSS score of 9.8, affecting specific versions of the server. Adding to the critical nature of the WebLogic fixes is CVE-2026-60702, a vulnerability with a CVSS score of 9.9. While this particular flaw requires a low-privileged authenticated user for exploitation, its impact on the WebLogic Core component via T3 or IIOP protocols can still be severe, compromising data confidentiality, integrity, and availability.
Beyond WebLogic Server, Oracle Fusion Middleware is a significant focus of this patch cycle, receiving 262 new security patches. Of these, 182 vulnerabilities are identified as remotely exploitable without authentication, making Fusion Middleware a prime target. The update also addresses a maximum-severity CVSS 10.0 flaw, CVE-2026-61241, within Oracle Internet Directory’s LDAP Server component.
Other Oracle products also receive attention, with Oracle Commerce getting 66 patches, including several remotely exploitable vulnerabilities rated at CVSS 9.8. Oracle E-Business Suite sees 120 patches, and Oracle Database Products receive 17 security fixes. High-impact issues are also addressed in Oracle Essbase, Enterprise Manager, Financial Services applications, and Oracle Hospitality Simphony.
Security teams are advised to prioritize patching internet-facing WebLogic servers, especially those exposing T3, IIOP, or RMI services to untrusted networks. Identifying affected versions, obtaining patches from Oracle’s Patch Availability Documents, and testing them in non-production environments before rapid deployment are crucial steps. For organizations unable to patch immediately, restricting access to exposed protocols and limiting network reachability are recommended interim measures, though Oracle emphasizes these workarounds do not eliminate the underlying vulnerabilities.
This extensive patch release underscores Oracle's ongoing commitment to addressing security weaknesses across its product lines. The sheer volume of vulnerabilities, particularly the critical ones in WebLogic Server, highlights the persistent threat landscape and the necessity for diligent patch management practices for organizations relying on Oracle's enterprise solutions.