Oracle released its largest quarterly Critical Patch Update of 2026 today, addressing 1,455 security vulnerabilities across its entire product portfolio — while one of those flaws is already being exploited in live intrusions by the notorious ShinyHunters threat group.
The July 2026 CPU, published on schedule this Tuesday, represents Oracle’s most expansive quarterly patch release to date. The breadth of the update spans Oracle Database, WebLogic Server, PeopleSoft, Fusion Middleware, Identity Manager, WebCenter, MySQL, GoldenGate, VirtualBox, and dozens of other product families. If your organization runs Oracle infrastructure — and statistically, most enterprises do — today is not the day to defer patching.
The Numbers That Should Wake Up Every Oracle DBA
The 1,455 patches in this CPU dwarf previous quarterly releases. For context, Oracle’s January 2026 CPU addressed 158 CVEs; April 2026 added 337 more. The July release nearly quadruples the April count, a trajectory that reflects both the growing complexity of Oracle’s product surface and the increasing effectiveness of AI-assisted vulnerability discovery across the industry.
Of the nearly 1,500 patches, Oracle has identified 5 as CRITICAL, carrying CVSS v3.1 base scores at or above 9.0. Over 12 additional vulnerabilities earn HIGH severity ratings (CVSS 7.0–8.9). The critical flaws are concentrated in products most commonly exposed at the enterprise perimeter: WebLogic Server, PeopleSoft, Identity Manager, and WebCenter.
Critical Vulnerabilities at a Glance
The most dangerous vulnerabilities in this update deserve direct attention:
CVE-2026-35263 — Oracle WebLogic Server (CVSS 9.9). A pre-authentication remote code execution flaw exploitable via WebLogic’s T3 and IIOP protocols. An unauthenticated attacker with network access to a vulnerable WebLogic instance can achieve full server compromise. WebLogic’s exposure as a common application server for financial, healthcare, and government systems makes this one of the most consequential flaws in the batch.
CVE-2026-35278 — Oracle PeopleSoft PeopleTools (CVSS 9.8, actively exploited). This is the red alert in the July CPU. An unauthenticated attacker with HTTP access can remotely execute arbitrary code on the PeopleSoft application server and the underlying host. Oracle confirmed the vulnerability is being actively exploited in the wild — and security researchers have observed the ShinyHunters group weaponizing it in live campaigns.
CVE-2026-35268 — Oracle Identity Manager (CVSS 9.9). A pre-authentication remote code execution flaw in Identity Manager (OIM), Oracle’s enterprise identity and access management platform. Given that OIM manages provisioning and access control for connected applications, compromise here can cascade into broader identity infrastructure.
CVE-2026-35270 and CVE-2026-35280/35281 — Oracle WebCenter (CVSS 9.1 and 9.9). Multiple critical RCE vulnerabilities across WebCenter Sites and WebCenter Capture. These content management and document capture platforms are frequently deployed facing internal enterprise users and, in some configurations, the internet.
ShinyHunters Is Already Inside PeopleSoft Networks
The most urgent dimension of this CPU is not the patch count — it is the confirmed, ongoing exploitation of CVE-2026-35278 and CVE-2026-35273 in PeopleSoft environments.
ShinyHunters, the threat group responsible for high-profile breaches at Microsoft, AT&T, and Ticketmaster in prior years, has evolved from data brokerage into active exploitation campaigns. Security researchers observing the group’s current campaigns describe a two-stage attack chain: CVE-2026-35278 delivers initial pre-authentication remote code execution on the PeopleSoft application server, while CVE-2026-35273 is used to escalate privileges and establish persistence. From there, the group pivots into PeopleSoft HCM databases to exfiltrate HR records, payroll data, and personally identifiable information.
Universities, healthcare systems, and state government agencies — all heavy PeopleSoft operators — are the primary targets observed so far. This mirrors the ShinyHunters campaign covered in June targeting university PeopleSoft environments; today’s CPU provides the official patches for the vulnerability chain they have been actively exploiting.
For any organization with internet-facing PeopleSoft infrastructure, Oracle security teams and independent researchers alike are calling for patch deployment within 72 hours. If patching cannot be completed within that window, restricting HTTP access to PeopleSoft interfaces to known trusted IP ranges is the minimum acceptable interim control.
PeopleSoft Bears the Biggest Burden
PeopleSoft accounts for 84 of the 1,455 patches in this CPU — the largest share of any single product family. Forty-five of those 84 vulnerabilities are remotely exploitable without authentication. That combination — high volume, high severity, no credentials required — makes PeopleSoft the single most critical patching target in Oracle’s July 2026 release.
Oracle GoldenGate, the company’s real-time data replication platform, receives 27 patches in this CPU, with the highest CVSS score for GoldenGate vulnerabilities reaching 9.1. Oracle Database Products receive 16 new patches, with 7 of those flaws remotely exploitable without authentication.
VirtualBox: The Guest-to-Host Escape
Rounding out the critical tier is CVE-2026-35275 in Oracle VirtualBox, rated CVSS 7.5. This guest-to-host escape vulnerability allows a malicious or compromised virtual machine to break out of the hypervisor sandbox and access the underlying host. For security operations teams running malware analysis environments, shared hosting infrastructure, or multi-tenant lab setups using VirtualBox, this is an immediate priority patch. A guest escape in an analysis VM can expose the analyst’s machine and connected network segments.
Kerberos and the Broader Security Posture
Separate from the CPU vulnerability patches, Microsoft’s own July 2026 patch release this month enforces mandatory Kerberos RC4 deprecation across Windows environments. Organizations running Oracle products integrated with Active Directory-based authentication should verify their Oracle-to-AD Kerberos configurations against the new enforcement requirements before applying either vendor’s patches in isolation.
What to Do Right Now
Oracle’s official guidance is to apply CPU patches as soon as possible. Given active exploitation in the wild, the prioritization should be:
Emergency tier (within 72 hours): PeopleSoft (CVE-2026-35278, CVE-2026-35273) and internet-facing WebLogic (CVE-2026-35263).
Urgent tier (within one week): Identity Manager (CVE-2026-35268), WebCenter Sites and Capture (CVE-2026-35270, CVE-2026-35280, CVE-2026-35281).
Standard tier (within the normal patch window): Oracle Database patches, GoldenGate patches, VirtualBox (CVE-2026-35275), and remaining HIGH-severity items.
For PeopleSoft specifically, Oracle recommends conducting a compromise assessment if any instance has been internet-facing in the past 60 days. Organizations should rotate all PeopleSoft and WebLogic administrative credentials after patching, since credential harvesting is a documented follow-on step in the ShinyHunters intrusion playbook.
Patches for all affected products are available through My Oracle Support. CPU patches are cumulative, meaning the July 2026 release subsumes all previous CPU patches for covered product versions — apply this one and you are current.
The scale of today’s release is a signal as much as a service event. Oracle’s product surface has grown to the point that a single quarterly update now addresses nearly 1,500 vulnerabilities. That is not a crisis unique to Oracle; it mirrors the trajectory at Microsoft, Adobe, and every other major enterprise software vendor. The era of comfortable quarterly patching cycles is over. When a ShinyHunters campaign can weaponize a CVSS 9.8 flaw between CPU cycles, the patch window is effectively the moment the advisory drops.
