By ByteBot
Oracle dropped its August 2026 Critical Security Patch Update on August 19. The release includes 943 patches for 925 CVEs across 23 product families. That is nearly four times the June CSPU volume. The headline items are a CVSS 10.0 flaw in Oracle Internet Directory and a cluster of WebLogic Server remote code execution vulnerabilities scoring 9.8 and 9.9. If your organization runs WebLogic, Fusion Middleware, or OID, this is not a schedule-it-for-next-week situation.
CVSS 10.0: Oracle Internet Directory Is Compromisable Without Credentials
CVE-2026-61241 is the one to address first. It carries a maximum CVSS score of 10.0 and sits inside the LDAP Server component of Oracle Internet Directory, versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access can send a crafted LDAP search request and fully compromise the OID server. No credentials, no user interaction required. The official advisory is at oracle.com/security-alerts/cspuaug2026.html.
OID is the authentication backbone in many Oracle enterprise environments. It handles identity for WebLogic, SOA Suite, and other Fusion Middleware components. Compromise one OID instance and lateral movement across every dependent system becomes possible.
WebLogic T3 and IIOP Problem Returns Again
The WebLogic cluster in this update follows a familiar pattern for anyone patching Oracle stacks. Four CVEs hit the WebLogic Server Core through the T3 and IIOP protocols. CyCognito published a detailed threat analysis of CVE-2026-60702 at cycognito.com.
- CVE-2026-60698 (CVSS 9.8): IIOP, unauthenticated. Affects WebLogic 12.2.1.4.0 through 15.1.1.0.0.
- CVE-2026-60702 (CVSS 9.9): T3 and IIOP, low-privileged attacker can fully take over the server. Oracle rates it easily exploitable.
- CVE-2026-60672 and CVE-2026-60696 (CVSS 9.8 each): Additional T3 and IIOP variants in the same Core component.
T3 and IIOP have been WebLogic attack surface for years. CVE-2020-2551 (IIOP, CVSS 9.8) was actively exploited. CVE-2024-21216 (T3 and IIOP, CVSS 9.8) was used by threat actors. CVE-2025-21535 (T3 and IIOP, CVSS 9.8) arrived January 2025. The cycle is predictable: Oracle patches, attackers reverse-engineer the fix, exploit code appears within days. If port 7001 is reachable from an untrusted network, that is a problem regardless of which CVE is currently trending.
The Scope Is Unusual
The June 2026 CSPU addressed 243 CVEs across 11 product families. This one covers 925 CVEs across 23 families. SecurityWeek reported the two heaviest recipients were Fusion Middleware and Hyperion, each receiving 262 patches. Of Fusion Middleware’s 262, 182 are remotely exploitable without authentication. Hyperion’s 262 include 107 such flaws. Oracle flagged more than 150 critical-severity patches and a total of 460-plus vulnerabilities exploitable remotely without credentials.
Oracle has indicated that AI-assisted vulnerability scanning is accelerating discovery across its portfolio. The volume spike is likely a sign of a large accumulated backlog being surfaced. That is the right move for Oracle, but it puts every team running these products in a difficult position with a very short patching window.
What You Should Do Now
Oracle’s official guidance is apply patches immediately. No compensating control fully resolves these vulnerabilities. Tenable’s analysis at tenable.com outlines a realistic patch priority for most organizations.
- Internet-facing Fusion Middleware instances first (262 patches, highest unauthenticated attack surface)
- Oracle Internet Directory (CVSS 10.0, authentication infrastructure)
- WebLogic Server (CVSS 9.8 and 9.9 cluster)
- Hyperion
If full patching cannot complete within 72 hours, implement compensating controls. Block external access to WebLogic admin ports 7001 and 7002. Restrict or disable T3 and IIOP at the perimeter. T3 should not be reachable from any untrusted network. Deploy WAF rules targeting known WebLogic deserialization patterns while patches are staged.
The August 2026 CSPU is worth taking seriously on its own terms. The 4x volume spike over June is itself a signal. Oracle’s AI-driven vulnerability discovery is unearthing flaws faster, and the attack surface for enterprise Oracle deployments is larger than most patch teams have time to assess. Teams that treat this as routine quarterly maintenance are the ones that end up in breach reports.
