Oracle's quarterly patch hits a record 1,455 fixes, with no-login takeover flaws in WebLogic and more (July 2026)

Oracle has released its July 2026 quarterly security update (Critical Patch Update, CPU). It fixes a record 1,455 issues, and among them are several flaws that let an attacker take over a server across the network with no login, rated the maximum severity of 10.0. The heaviest impact is on the "Fusion Middleware" family — Oracle WebLogic Server, Oracle Coherence, and Oracle Access Manager — the foundation of many enterprise systems.

If you run these products, internet-facing servers in particular need urgent attention. Oracle middleware like WebLogic has repeatedly been hit worldwide right after disclosure and suffered real takeovers — a perennial target. Here's what was released and which fixes to prioritize.

What is Oracle's quarterly patch (CPU)?

Oracle's Critical Patch Update (CPU) is a bundle of security fixes the company ships every three months (January, April, July, October). Because it covers Oracle's vast portfolio at once — databases, Java, middleware like WebLogic, and business systems like E-Business Suite and PeopleSoft — a single release runs to hundreds or over a thousand fixes. This July 2026 edition was a record 1,455 fixes.

With that many, you have to zero in on "the ones that affect us" — and what deserves the most attention is anything rated at the top severity and exploitable with no login (unauthenticated). This release has many that fit, and Oracle itself strongly recommends applying the fixes as soon as possible. Fusion Middleware alone got 359 fixes, 224 of them remotely exploitable without authentication, with the 10.0 top score hitting Oracle Access Manager, WebLogic Server, and Coherence.

Who targets this, and why

The people who go after these unauthenticated Oracle-middleware flaws are attackers who mechanically sweep the internet for exposed WebLogic and similar servers. For ransomware crews and organized intrusion groups, a widely used core middleware like WebLogic is an ideal entry point. Once a fix ships, the technique is inferred from the diff within days, and unpatched servers are targeted en masse.

The attacker aims to run arbitrary code on the server with no login and take the whole system over. A successful takeover leads to theft of the business data the server handles, ransomware encryption and extortion, and a foothold deeper into the internal network. WebLogic has in fact had flaws from past CPUs exploited right after release and listed repeatedly on the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog (see our roundup of WebLogic exploitation).

The damage isn't just the server admin's problem. If core systems or middleware are taken over, the entire business riding on them — customer data, data exchange with partners — is exposed. That is why you should act on the priorities below without delay.

The "no-login takeover" flaws to prioritize (examples)

Of the 1,455 fixes, the first to prioritize are those exploitable over the network with no login that fully compromise the server. Below are representative examples (severity and preconditions per NVD). All are fixed in the July 2026 CPU.

These are just examples; Oracle's advisory notes that Oracle Access Manager and WebLogic Server itself also carry 10.0 flaws. The CPU also includes a PeopleSoft flaw reported behind 100+ breaches, plus fixes for Oracle Identity Manager and more. Because the count is huge, always confirm the exact CVEs for the products you run against Oracle's official list.

Does it affect you, and what to prioritize

Not all 1,455 apply to you. First, inventory the Oracle products you run, then check only the CVEs for those products against the per-product CPU list. From there, this order helps you prioritize efficiently.

WebLogic in particular sees repeated attacks abusing its proprietary protocols (T3/IIOP) for external communication. Even if you can't patch immediately, keeping those protocols and admin consoles unreachable from the internet — narrowing the entry points — greatly shrinks the attack surface.

What to do right now

The basic response is to apply the July 2026 CPU. Oracle's Critical Patch Update Advisory (July 2026) lists the applicable CVEs and where to get the patches, per product. Identify the products you run, and following the priorities above, patch internet-facing middleware first.

If you can't patch right away, useful stopgaps are to block WebLogic admin consoles and T3/IIOP traffic from the internet and restrict source addresses. But that only buys time — the real fix is the patch. Also check for unfamiliar admin accounts or suspicious traffic, in case you've already been compromised.

As of publication, we haven't confirmed reports of large-scale real-world exploitation of the individual flaws in this CPU, but WebLogic-class middleware is known for fast post-disclosure abuse. You can check whether anything has been added to the U.S. CISA catalog of actively exploited vulnerabilities in our tracker of actively exploited vulnerabilities (Japanese).

Summary

Oracle's July 2026 quarterly patch (CPU) fixed a record 1,455 issues. The dangerous part is that 10.0 flaws that take over a server with no login exist in widely used middleware like WebLogic Server, Coherence, and Access Manager. Fusion Middleware alone accounts for 359 fixes, 224 of them remotely exploitable without authentication, and core systems like E-Business Suite and PeopleSoft are affected too.

The response is to inventory the Oracle products you run and apply the July 2026 CPU, patching internet-facing WebLogic and other middleware first. WebLogic has repeatedly been exploited right after disclosure, and a delayed patch becomes the entry point for takeover. Don't get lost in the sheer count — act first on anything that is "unauthenticated, 10.0, and internet-facing."

Sources

• ▸ Oracle - Critical Patch Update Advisory - July 2026 (official, per-product list)
• ▸ Threat-Modeling.com - Oracle July 2026 Critical Patch Update analysis
• ▸ TechTimes - Record July CPU patches a PeopleSoft exploit tied to 100+ breaches
• ▸ NVD - CVE-2026-60217 (Oracle Coherence, 10.0, unauthenticated) and the other CVEs above
• ▸ Related: roundup of Oracle WebLogic exploitation (this site)
• ▸ Related: tracker of actively exploited vulnerabilities, CISA KEV (Japanese, this site)