Full Report
Experts say the era of AI bug hunting is here, so defenders will simply have to adapt to busier workloads
Analysis Summary
# Vulnerability: Massive Oracle Quarterly Patch Update (July 2026)
## CVE Details
- **CVE ID:** CVE-2026-47056, CVE-2026-60217, CVE-2026-61211, CVE-2026-47040 (Key highlights among 1,449 total patches)
- **CVSS Score:** 10.0 (CVE-2026-47056, CVE-2026-60217) | 9.9 (CVE-2026-61211) | 9.1 (CVE-2026-47040)
- **CWE:** Not specifically cataloged in high-level report; described generally as Remote Code Execution (RCE) and Authentication Bypass.
## Affected Systems
- **Products:**
- Oracle Fusion Middleware (specifically Oracle Data Integrator and Oracle Coherence)
- Oracle Database Server (specifically Oracle Net Service and DBMS_CLOUD package)
- Extensive list across the Oracle product portfolio.
- **Versions:** Multiple versions across the enterprise suite (Consult Oracle's July 2026 CPU for exhaustive list).
- **Configurations:**
- Systems exposed to HTTP (Data Integrator).
- Systems exposed to TCP (Coherence).
- Database instances utilizing the DBMS_CLOUD package.
## Vulnerability Description
This release addresses an unprecedented 1,449 vulnerabilities, many discovered through Oracle's internal AI-assisted bug-hunting initiatives.
- **Fusion Middleware flaws (CVE-2026-47056 & CVE-2026-60217):** Critical flaws allowing unauthenticated attackers to take over service instances remotely.
- **Oracle Net Service (CVE-2026-47040):** A flaw allowing unauthenticated access to stored data and the ability to cause a persistent Denial of Service (DoS).
- **DBMS_CLOUD (CVE-2026-61211):** A high-risk vulnerability where a low-privilege attacker can achieve Remote Code Execution (RCE) and gain full control over the Relational Database Management System (RDBMS).
## Exploitation
- **Status:** Described as "easily exploitable"; high risk of exploitation due to lack of authentication requirements.
- **Complexity:** Low (for highlighted critical CVEs).
- **Attack Vector:** Network (HTTP, TCP, and Oracle Net).
## Impact
- **Confidentiality:** Total (Full access to stored data and system takeover).
- **Integrity:** Total (Ability to execute malicious code).
- **Availability:** Total (Persistent service crashing and system takeover).
## Remediation
### Patches
- **Cumulative Update:** Apply the **July 2026 Critical Patch Update (CPU)** immediately.
- **CSPUs:** Oracle has moved to a monthly "Critical Security Patch Update" cycle for the most severe bugs; admins should check for May and June 2026 supplements.
### Workarounds
- Fast-track patches for systems with maximum CVSS (10.0) scores.
- Restrict network access to Oracle Data Integrator and Coherence ports to trusted IPs only.
- Audit and restrict usage of the `DBMS_CLOUD` package to essential users only.
## Detection
- **Indicators of Compromise:** Monitor for unusual HTTP/TCP traffic patterns targeting Fusion Middleware ports. Watch for unauthorized RDBMS execution via the `DBMS_CLOUD` package.
- **Detection methods and tools:** Utilize Oracle Integrated Cyber Center tools and automated scanning tools (e.g., Pentest-Tools.com or Huntress) to identify unpatched instances.
## References
- Oracle July 2026 Security Alert: hxxps[://]www[.]oracle[.]com/security-alerts/cpujul2026[.]html
- Oracle Security Blog: hxxps[://]blogs[.]oracle[.]com/security/accelerating-vulnerability-detection-and-response-at-oracle
- Dutch NCSC Advisory: hxxps[://]www[.]ncsc[.]nl/alerts/update-oracle-fusion-middleware-direct-vanwege-kritieke-kwetsbaarheden