Oracle’s August 2026 patch release addresses 943 vulnerabilities across its enterprise software portfolio.
Several of the critical WebLogic Server flaws could allow remote attackers to compromise vulnerable systems without authentication.
Key takeaways of the Oracle August 2026 security update
- Oracle patched 943 vulnerabilities across its enterprise software portfolio as part of its August 2026 security update.
- Several critical WebLogic Server vulnerabilities are remotely exploitable without authentication, including CVSS 9.8 flaws reachable through T3, IIOP, and RMI.
- CVE-2026-60702 carries a CVSS score of 9.9 and could allow a low-privileged attacker with existing access to further compromise WebLogic environments.
- Oracle Fusion Middleware received 262 security fixes, including 182 addressing vulnerabilities that can be remotely exploited without authentication.
- CVE-2026-61241 received the maximum CVSS score of 10.0 and affects the LDAP Server component of Oracle Internet Directory.
Oracle WebLogic vulnerabilities explained
Oracle’s August update patches vulnerabilities across its enterprise portfolio, including Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, PeopleSoft, and other platforms.
Several of the most critical fixes affect Oracle WebLogic Server, where remotely exploitable vulnerabilities could compromise business critical applications and sensitive data.
CVE-2026-60698
CVE-2026-60698 is a critical WebLogic Server Core vulnerability with a CVSS score of 9.8 that can be remotely exploited without authentication via IIOP.
CVE-2026-60672
CVE-2026-60672 is a CVSS 9.8 WebLogic Server Core flaw reachable through T3 and IIOP.
An unauthenticated remote attacker could exploit the vulnerability to compromise affected WebLogic environments.
CVE-2026-60696
CVE-2026-60696 also carries a CVSS score of 9.8 and affects WebLogic Server Core through T3 and IIOP.
The vulnerability requires no authentication and could allow a remote attacker to compromise data and services on an affected server.
CVE-2026-60977
Oracle also addressed CVE-2026-60977, a CVSS 9.8 vulnerability affecting WebLogic Server WLS Core Components.
The flaw can also be remotely exploited via RMI, providing another attack path when the affected service is exposed to untrusted networks.
CVE-2026-60702
The most severe WebLogic vulnerability addressed in the release, CVE-2026-60702, carries a CVSS score of 9.9 and affects WebLogic Server Core through T3 and IIOP.
Although exploitation requires low-privileged authentication, an attacker with existing access could leverage the flaw to further compromise the affected environment.
Fusion Middleware receives 262 security fixes
The August update extends beyond WebLogic, with Oracle Fusion Middleware receiving 262 security patches, including 182 that address vulnerabilities remotely exploitable without authentication.
CVE-2026-61241
Among the most critical flaws is CVE-2026-61241, a CVSS 10.0 vulnerability in the LDAP Server component of Oracle Internet Directory.
An unauthenticated attacker with network access to the LDAP service can remotely exploit affected systems without valid credentials.
Oracle did not report any active exploitation of these vulnerabilities at the time of publication.
How to reduce Oracle security risks
Organizations should prioritize remediation based on system exposure, vulnerability severity, and the criticality of affected workloads.
- Apply the latest fixes and prioritize internet-facing servers based on exploitability, exposure, and business criticality.
- Restrict or disable unnecessary T3, IIOP, RMI, and administrative access using network controls, VPNs, allowlists, or dedicated management networks.
- Segment WebLogic servers and restrict outbound connectivity to limit lateral movement and attacker command-and-control activity after a compromise.
- Harden privileged access and review exposed secrets including administrator accounts, service credentials, API keys, certificates, and database credentials.
- Hunt for signs of compromise including web shells, unexpected processes, modified applications, new accounts, suspicious deployments, and unusual network connections.
- Centralize and preserve security telemetry from WebLogic, operating systems, authentication systems, WAFs, and network controls to support detection and investigation.
- Test incident response plans, use attack simulation tools, and tabletop exercises.
Together, these measures can reduce exposure to WebLogic attacks while strengthening resilience against exploitation and subsequent compromise.
Bottom line
Oracle’s August 2026 release is a reminder to treat large quarterly patch cycles as a risk prioritization exercise rather than a simple patch counting task.
The concentration of unauthenticated, remotely exploitable flaws in WebLogic and Fusion Middleware makes external exposure, protocol reachability, and asset criticality key factors for remediation sequencing.
Security teams should also verify that vulnerable middleware is fully inventoried, compensating controls are enforceable where patching is delayed, and detection coverage is sufficient to identify exploitation attempts.
Zero Trust solutions can further help reduce exposure by continuously validating access and limiting blast radius.