Oracle July 2026 CPU Fixes 1,235 CVEs in Record Update
Oracle's July 2026 CPU Delivers a Record 1,449 Security Patches
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
On July 21, 2026, Oracle released its July 2026 Critical Patch Update (CPU), a historically massive security release that addresses 1,449 new vulnerabilities across its extensive product portfolio. The update resolves 1,235 unique CVEs, with 261 patches rated as critical. The sheer volume of fixes, nearly five times that of the previous year's equivalent update, underscores a significant increase in vulnerability discovery and reporting, partly attributed to AI-powered code analysis. The Oracle E-Business Suite was the most patched product. A standout vulnerability is CVE-2026-60880, a CVSS 9.8 flaw allowing remote takeover of a key module. In response to this scale, Oracle announced a new parallel monthly patching cycle, signaling a major shift in its security update strategy.
Vulnerability Details
The July 2026 CPU is notable for both its size and the severity of the flaws addressed. Many of the vulnerabilities are remotely exploitable without authentication, posing a severe risk to organizations.
- Total Patches: 1,449 new security patches.
- Unique CVEs: 1,235.
- Critical Patches (CVSS 9.0-10.0): 261 patches for 228 CVEs (18% of total).
- High Severity Patches (CVSS 7.0-8.9): Constituted 52.7% of the release.
One of the most severe vulnerabilities highlighted is:
CVE-2026-60880: A critical (CVSS 9.8) vulnerability in the Work in Process module of the Oracle E-Business Suite. This flaw can be exploited by an unauthenticated attacker with network access, potentially leading to a complete takeover of the targeted component.
Affected Systems
The patches span 32 different Oracle product families. Key affected products include:
- Oracle E-Business Suite: Received the highest number of patches (410, or 28.3% of the total).
- Oracle Database Server: A core product with numerous critical fixes.
- Oracle SQL Developer: Patches address flaws in this widely used database IDE.
- Oracle Coherence: Fixes for the in-memory data grid product.
- TimesTen In-Memory Database: Vulnerabilities addressed in the high-performance database.
Given the broad range of affected products, nearly all Oracle customers are impacted and must review the advisory to determine their specific exposure.
Exploitation Status
While the advisory does not specify if any of the 1,235 CVEs are actively exploited in the wild, the presence of numerous remotely exploitable, no-authentication-required vulnerabilities means that exploitation is highly likely. Threat actors routinely reverse-engineer patches to develop exploits, making rapid deployment critical. Organizations like NHS England have issued alerts emphasizing the urgency of applying these updates.
Impact Assessment
Failing to apply these patches exposes organizations to significant risk, including data breaches, system takeovers, and severe business disruption. A successful exploit of a critical vulnerability like CVE-2026-60880 in the E-Business Suite could allow an attacker to manipulate financial data, steal sensitive information, or disrupt core business processes. The sheer number of patches presents a major operational challenge for IT and security teams, requiring careful planning and prioritization. The introduction of a new monthly patching cadence, while intended to be more agile, will require organizations to adapt their vulnerability management programs to a more frequent update cycle.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
/OA_HTML/ORACLE_HOME/Detection Methods
- Vulnerability Scanning: Use authenticated scans from vendors like Tenable to accurately identify vulnerable Oracle product versions across the environment.
- Version Checking: Manually check the versions of installed Oracle products against the detailed list in the CPU advisory to identify affected systems.
- Log Analysis: Monitor database and application logs for anomalous activity, such as connections from untrusted IP addresses or unusual SQL queries, which could indicate an attempted or successful exploit. Utilize D3-NTA: Network Traffic Analysis to detect suspicious network connections to database servers.
Remediation Steps
- Prioritize Patching: Focus first on patching internet-facing systems, followed by critical internal systems like the E-Business Suite and core databases. Use the CVSS scores to guide prioritization, addressing the 261 critical patches first.
- Apply Updates: Follow Oracle's documentation to apply the relevant patches for your specific products and versions. The CPU advisory provides detailed information on affected components and patch availability.
- Test Patches: Before deploying to production, test patches in a non-production environment to ensure they do not cause operational issues.
- Implement Compensating Controls: If patching cannot be done immediately, implement compensating controls such as restricting network access to vulnerable systems, enhancing monitoring, and using a Web Application Firewall (WAF) to block exploit attempts. This aligns with D3-ACH: Application Configuration Hardening.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to apply the 1,449 patches provided by Oracle in a prioritized manner.
Mapped D3FEND Techniques:
Restrict network access to Oracle databases and application servers from untrusted networks as a compensating control.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most critical action for any organization using Oracle products is the immediate and prioritized application of the July 2026 CPU. Given the massive scale of 1,449 patches, a risk-based approach is essential. Use a vulnerability scanner to identify all affected Oracle assets. Prioritize patching based on two factors: exploitability and asset criticality. First, patch all internet-facing systems (e.g., E-Business Suite web portals). Second, patch systems with vulnerabilities rated 'Critical' (CVSS 9.0+), such as the one identified by CVE-2026-60880. Third, patch business-critical internal systems. Due to Oracle's new monthly cadence, organizations must streamline their patch management lifecycle—from identification and testing to deployment and verification—to handle this increased frequency. Automating parts of this process will be key to staying protected.
For organizations unable to immediately apply the 1,449 patches, Application Configuration Hardening serves as a vital compensating control. This involves reviewing and securing the configuration of Oracle products to reduce their attack surface. For Oracle Database, this means disabling unused features and services, enforcing strong password policies for database accounts, and revoking public grants on sensitive PL/SQL packages. For Oracle E-Business Suite, it involves implementing secure cookie settings, restricting access to administrative interfaces, and ensuring all web-facing components are configured according to Oracle's security guidelines. This proactive hardening can mitigate many vulnerabilities even before a patch is applied, making it harder for an attacker to successfully exploit a flaw.
To protect unpatched Oracle systems, especially those that are internet-facing like E-Business Suite, deploying a Web Application Firewall (WAF) with virtual patching capabilities is highly effective. A WAF can be configured with rules to inspect inbound HTTP/HTTPS traffic for patterns matching known exploit techniques against Oracle vulnerabilities. This acts as a shield, blocking malicious requests before they reach the vulnerable application. For database servers, network firewalls should be configured with strict Inbound Traffic Filtering rules, allowing connections to the listener port (e.g., 1521) only from trusted application servers. Denying all other access from the broader network severely limits an attacker's ability to exploit a remote database vulnerability.
Timeline of Events
Oracle releases its July 2026 Critical Patch Update with 1,449 new security patches.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.