https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Oracle.Sun, 26 Jul 2026 22:32:51 GMThttps://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.htmlcst-3211Attackers are actively exploiting CVE-2026-16723, a critical remote code execution vulnerability in Alibaba's Fastjson JSON library for Java. The flaw allows unauthenticated code execution in affected Spring Boot applications with a CVSS score of 9.0. No patched version is currently available.Sat, 25 Jul 2026 12:52:43 GMThttps://isc.sans.edu/diary/rss/33176cst-3040Geoserver instances are being targeted with CVE-2024-36401, an X-Path expression evaluation flaw, to deploy the Rondo botnet. The exploit chain attempts to download and execute a shell script from a remote server, though evidence suggests the malware may have been subsequently removed from affected hosts. This represents a continuation of Rondo's documented interest in Geoserver as an attack vector.Wed, 22 Jul 2026 17:35:33 GMThttps://securityweek.com/oracle-patches-over-1400-vulnerabilities-with-quarterly-security-updatescst-2986Oracle released its July 2026 Critical Patch Update addressing over 1,400 vulnerabilities. The update includes fixes for flaws that were likely identified through artificial intelligence (AI) discovery methods.Wed, 22 Jul 2026 09:33:12 GMThttps://tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cvescst-2966Oracle released its July 2026 Critical Patch Update on July 21, addressing 1235 unique CVEs across 1449 patches spanning 32 product families. The release included 261 critical patches (18% of all patches), with Oracle E-Business Suite and Fusion Middleware receiving the largest share of fixes. The update covers vulnerabilities across multiple severity levels, with 219 patches in Fusion Middleware exploitable remotely without authentication.Tue, 21 Jul 2026 21:07:46 GMThttps://bleepingcomputer.com/news/security/est-e-lauder-discloses-data-breach-via-oracle-e-business-flawcst-2875Estée Lauder disclosed a data breach resulting from attackers exploiting a vulnerability in Oracle E-Business Suite, which the company deployed for HR operations. The breach affected customer data stored within systems accessible through the compromised application.Mon, 20 Jul 2026 22:39:30 GMThttps://bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturdaycst-2669The Cybersecurity and Infrastructure Security Agency (CISA) has issued a mandatory directive requiring federal agencies to patch a critical vulnerability in Oracle E-Business Suite that is currently being exploited in active attacks. The deadline for remediation is Saturday.Thu, 16 Jul 2026 10:56:03 GMThttps://cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalogcst-2622CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-4346 affecting KNX Protocol and CVE-2026-46817 in Oracle E-Business Suite. The agency emphasized that federal agencies must prioritize patching these vulnerabilities under Binding Operational Directive 26-04, and encouraged all organizations to adopt risk-based vulnerability management.Wed, 15 Jul 2026 12:00:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5099539-extended-security-updatecst-2513Microsoft released Windows 10 KB5099539, an extended security update containing July 2026 Patch Tuesday fixes for 570 vulnerabilities and additional security patches. This update addresses a substantial volume of identified flaws across the Windows 10 platform.Tue, 14 Jul 2026 18:49:28 GMThttps://schneier.com/blog/archives/2026/07/ai-data-centers-and-the-concentration-of-wealth.htmlcst-2409An essay argues that while local opposition to AI data center construction raises legitimate concerns about resource allocation, environmental impact, and job creation, this focus may distract from AI companies' larger goal of capturing value across major industries like software development, healthcare, and law. The authors contend that despite some successful campaigns against early-stage projects, well-capitalized proposals continue to advance through litigation and political support, while the real strategic prize for AI companies lies in displacing professionals across multiple sectors.Mon, 13 Jul 2026 11:01:57 GMThttps://schneier.com/blog/archives/2026/07/ai-surveillance-and-social-progress.htmlcst-2316AI-powered surveillance systems combining facial recognition, real-time tracking, and automated enforcement are being deployed globally to monitor public behavior and issue immediate sanctions for rule violations. China operates over 600 million surveillance cameras integrated with social credit systems that publicly shame and restrict citizens deemed untrustworthy, while similar systems are being tested in North America, Europe, and other regions. The technology's primary impact may be widespread self-censorship and behavioral conformity rather than objective public safety.Fri, 10 Jul 2026 11:02:04 GMThttps://blog.talosintelligence.com/uat-7810cst-516Cisco Talos is tracking UAT-7810, a China-nexus APT actor that builds and maintains Operational Relay Box (ORB) networks for use by secondary threat actors. UAT-7810 has developed and deployed new malware variants including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, targeting Linux and embedded devices across multiple architectures. The group exploits known vulnerabilities in Ruckus wireless routers and ASUS AiCloud routers from infrastructure in Eastern Europe and Hong Kong.Tue, 07 Jul 2026 10:00:05 GMThttps://research.checkpoint.com/2026/6th-july-threat-intelligence-report-2cst-594A threat intelligence bulletin reports multiple significant incidents across sectors: ransomware attacks affecting financial, defense, manufacturing, and insurance organizations; artificial intelligence threats including LLM-generated ransomware, unsafe coding agents, and phishing domain hijacking; and critical vulnerabilities in Oracle, Linux, Citrix, and Progress products with active exploitation observed.Mon, 06 Jul 2026 12:01:54 GMThttps://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.htmlcst-20Researchers have identified QuimaRAT, a Java-based remote access trojan (RAT) marketed as a malware-as-a-service (MaaS) offering that targets Windows, Linux, and macOS. The malware is sold through subscription tiers ranging from $150 per month to $1,200 for lifetime access.Mon, 06 Jul 2026 08:13:33 GMThttps://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanzacst-554Adobe released a security advisory on June 30 addressing multiple critical vulnerabilities in ColdFusion 2025 (Update 9 and below) and ColdFusion 2023 (Update 20 and below), including several arbitrary code execution flaws, privilege escalation issues, and file system access vulnerabilities. The analysis highlights that several vulnerabilities involve the Remote Development Services (RDS) feature, which requires being explicitly enabled and having authentication disabled to be exploited, and researchers note difficulty in mapping all disclosed CVEs to specific vulnerability details.Thu, 02 Jul 2026 16:38:28 GMThttps://cyberscoop.com/oracle-ebs-critical-vulnerability-exploitedcst-141Researchers detected six instances of exploitation against a critical Oracle E-Business Suite vulnerability (CVE-2026-46817, CVSS 9.8) within a two-hour window on honeypots, likely representing early reconnaissance and weaponization testing. Shadowserver scans identified approximately 950 potentially vulnerable Oracle E-Business Suite instances, with over half publicly exposed in the United States. Oracle patched the payments processing defect in late May, and the discovery follows a history of similar Oracle products being targeted by ransomware groups and other threat actors in widespread campaigns.Wed, 01 Jul 2026 19:23:26 GMThttps://blog.qualys.com/category/vulnerabilities-threat-researchcst-391Oracle released its June 2026 Critical Patch Update addressing 245 security vulnerabilities across multiple product families, with Oracle Fusion Middleware receiving the most patches at 106. The update includes patches for critical vulnerabilities in Fusion Middleware, E-Business Suite, JD Edwards, MySQL, and PeopleSoft, many of which can be exploited remotely without credentials and may lead to remote code execution. Qualys has published associated QID coverage for vulnerability scanning and assessment.Thu, 18 Jun 2026 14:30:21 GMThttps://arstechnica.com/security/2026/06/massive-breach-spills-credentials-for-thousands-of-sensitive-networkscst-431Researchers discovered a massive breach affecting approximately 74,000 Fortinet firewalls across more than 21,000 organizations in 194 countries, with plaintext credentials exposed online. Russian-speaking attackers gained access to sensitive networks at major organizations including Oracle, Chevron, Lenovo, Federal Express, and NATO defense contractors. In many cases, threat actors leveraged the compromised devices to access centralized authentication systems such as Active Directory and Radius servers.Wed, 17 Jun 2026 19:54:31 GMThttps://arstechnica.com/security/2026/06/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-datacst-436The ransomware group ShinyHunters exploited a critical server-side request forgery (SSRF) vulnerability in Oracle's PeopleSoft software (CVE-2026-35273, CVSS 9.8) to target approximately 100 customers and conduct extortion attacks. The vulnerability was actively exploited for over two weeks before Oracle disclosed it, and victims have received extortion demands from the threat actors. Oracle has released a temporary mitigation but a full patch has not yet been released.Fri, 12 Jun 2026 19:26:47 GMThttps://rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273cst-377Oracle released an emergency patch on June 10, 2026 for CVE-2026-35273, a critical server-side request forgery vulnerability in PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 that allows unauthenticated remote code execution. The vulnerability was actively exploited in the wild by UNC6240 (ShinyHunters) for nearly two weeks before Oracle's advisory, primarily targeting higher education institutions, with stolen data published on the attacker's leak site on June 9, 2026. Post-exploitation activity included deployment of remote management tools masquerading as Azure services and exfiltration of PeopleSoft configuration data.Fri, 12 Jun 2026 13:43:04 GMThttps://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploitcst-308Mandiant and Google Threat Intelligence identified UNC6240 (ShinyHunters) exploiting CVE-2026-35273, a critical remote code execution vulnerability in Oracle PeopleSoft's Environment Management component, between late May and early June 2026. The campaign primarily targeted higher education institutions in the United States, with attackers using custom MeshCentral agents for lateral movement and subsequently publishing stolen data on ShinyHunters' leak site. The exploitation occurred before Oracle's patch advisory, making it a zero-day attack that affected over 100 organizations.Thu, 11 Jun 2026 14:00:00 GMThttps://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520cst-559Ivanti released an advisory for two critical vulnerabilities in its Sentry product: CVE-2026-10520, a pre-authenticated OS command injection flaw allowing unauthenticated remote code execution with CVSS 10.0, and CVE-2026-10523, an authentication bypass enabling creation of arbitrary administrative accounts. Both vulnerabilities affect Ivanti Sentry versions before R10.5.2, R10.6.2, and R10.7.1.Wed, 10 Jun 2026 00:52:20 GMThttps://thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedulecst-393Pwn2Own Berlin 2026 is a competitive hacking event held at OffensiveCon featuring security researchers attempting to exploit vulnerabilities in enterprise software across multiple categories including AI databases, coding agents, web browsers, and NVIDIA products. The competition schedule spans three days in May 2026, with researchers competing for prize pools ranging from $20,000 to $175,000 and Master of Pwn points based on vulnerability severity and impact.Wed, 13 May 2026 16:23:07 GMThttps://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threatcst-2119LeakNet ransomware operators are expanding their attack capabilities by adopting ClickFix social engineering lures hosted on compromised websites and deploying a Deno-based in-memory loader for command-and-control delivery. The group maintains a consistent post-exploitation sequence across incidents, including jli.dll side-loading into Java, PsExec lateral movement, and S3 bucket payload staging. This shift toward self-directed campaigns reduces LeakNet's reliance on initial access brokers and accelerates their timeline from initial compromise to encryption.Tue, 17 Mar 2026 09:00:00 GMThttps://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-scst-565SolarWinds Web Help Desk has been found to contain multiple pre-authentication remote code execution vulnerabilities via Java deserialization, including CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554. Researchers achieved RCE on a fully patched instance by chaining an authentication bypass with a deserialization flaw, demonstrating that previous patches for similar 2024 vulnerabilities did not fully address the underlying issues. This continues a pattern of recurring deserialization problems in the product.Wed, 25 Feb 2026 20:06:32 GMThttps://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomwarecst-577A threat actor exploited CVE-2023-46604 on an exposed Apache ActiveMQ server in mid-February 2024 to achieve remote code execution using a Java Spring class, leading to LockBit ransomware deployment. The intrusion demonstrates how unpatched critical vulnerabilities in internet-facing services remain an effective attack vector for ransomware operators.Mon, 23 Feb 2026 14:09:43 GMThttps://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340cst-566Ivanti released patches for two pre-authentication remote code execution vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Endpoint Manager Mobile (EPMM), an enterprise mobility management platform used to control corporate mobile devices. The vulnerabilities are actively exploited in the wild and have been added to CISA's Known Exploited Vulnerabilities list. Permanent patches are not available until Q1 2026; customers are currently receiving temporary RPM patches that must be reapplied after system updates to remain effective.Fri, 30 Jan 2026 16:15:16 GMThttps://wiz.io/blog/wiz-supports-oracle-cloud-identitycst-1371Wiz has integrated Oracle Cloud Infrastructure (OCI) identity management capabilities into its Security Graph platform, providing unified visibility across OCI identities, permissions, and policies. This integration enables security teams to map and visualize identity configurations within Wiz's broader cloud security posture framework.Mon, 22 Dec 2025 13:00:00 GMThttps://wiz.io/blog/introducing-dspm-for-oracle-cloud-infrastructurecst-1616Wiz has added Data Security Posture Management (DSPM) capabilities to its Cloud Native Application Protection Platform (CNAPP) offering, enabling Oracle Cloud Infrastructure customers to better identify and protect sensitive data in their environments. This integration provides CNAPP users with built-in data security visibility without requiring separate tools.Thu, 14 Mar 2024 14:39:40 GMThttps://huntress.com/blog/critical-vulnerability-disclosure-connectwise-r1soft-server-backup-manager-remote-code-execution-supply-chain-riskscst-1107Huntress confirmed an authentication bypass and sensitive file disclosure vulnerability in the ZK Java framework used by ConnectWise R1Soft Server Backup Manager SE. The flaw allows unauthorized access and exposure of sensitive data in the backup management software. This represents a supply chain security risk affecting organizations relying on this widely used backup solution.Mon, 31 Oct 2022 00:00:00 GMThttps://wiz.io/blog/attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-accesscst-1786AttachMe was a critical vulnerability in Oracle Cloud Infrastructure (OCI) that allowed unauthorized access to and modification of other users' storage volumes, violating cloud isolation. Oracle patched the vulnerability within hours of disclosure, and no customer action was required.Tue, 20 Sep 2022 12:57:00 GMThttps://wiz.io/blog/wiz-extends-cnapp-leadership-with-protection-for-alibaba-cloudcst-1799Wiz announced support for Alibaba Cloud in its cloud native application protection platform (CNAPP), extending its coverage across multiple cloud providers. This follows the recent launch of Oracle Cloud Infrastructure (OCI) integration, broadening the platform's multi-cloud capabilities.Thu, 30 Jun 2022 05:40:59 GMThttps://wiz.io/blog/supporting-oracle-cloud-wiz-brings-the-first-graph-based-cloud-security-approach-to-all-major-providerscst-1803Wiz, a cloud security company, has announced integration with Oracle Cloud Infrastructure (OCI), extending its graph-based security approach across all major cloud providers. The integration enables enterprises like Avery Dennison to maintain security visibility and governance across their OCI deployments alongside other cloud environments.Thu, 02 Jun 2022 05:30:16 GMThttps://huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-javacst-1161Huntress released analysis of CVE-2021-44228, a critical remote code execution vulnerability in the Java logging library Log4j that enables unauthenticated attackers to execute arbitrary code on affected systems.Fri, 10 Dec 2021 00:00:00 GMT