Vulnerabilities · 103 days ago
Oracle’s June CSPU is more than a bulk maintenance release. The problem is the mix: Oracle has a large patch wave, but the actively exploited PeopleSoft issue is still overdue, and unpatched Fusion Middleware stays the easiest remotely reachable path into Oracle estates.
Oracle says the June 16 CSPU covers 243 CVEs in 245 updates across 11 product families. Fusion Middleware accounts for 106 of those fixes, and the KEV-listed PeopleSoft flaw, CVE-2026-35273, remains past deadline after being exploited in the wild as a zero-day.
That leaves Oracle environments facing two separate pressures at once: an overdue exploited bug and a dense cluster of network-reachable middleware fixes. The patch count is not the story; the exposed admin and middleware surface is.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 9% (95th percentile).
CISA federal remediation date Jun 15 · date passed
15 sources covering this story
Oracle releases 245 new security patches, all rated ‘high-priority security’
The updates apply to multiple products and also include fixes for third-party components
Oracle Critical Patch Update, June 2026 Security Update Review | Qualys
Oracle released its third quarterly edition of this year’s Critical Patch Update.
Oracle Critical Security Patch Update June 2026 | Tenable®
Oracle’s Critical Security Patch Update (CSPU) for June 2026, its second CSPU, addresses 243 CVEs, including 122 critical updates.
Kwetsbaarheden verholpen in Oracle Fusion Middleware producten
Oracle heeft meerdere kwetsbaarheden verholpen in verschillende producten binnen de Oracle Fusion Middleware suite, waaronder WebLogic Server, WebCenter Content, WebCenter Sites, WebCenter Portal, WebCenter Enterprise Capture, Identity Manager, Identity Manager Connector, Access Manager, Coherence, Unified Directory, Virtual Directory en Application...
Kwetsbaarheden verholpen in Oracle JD Edwards EnterpriseOne
De kwetsbaarheden in Oracle JD Edwards EnterpriseOne stellen een aanvaller in staat om zonder...
Kwetsbaarheden verholpen in Oracle MySQL-producten
De kwetsbaarheden bevinden zich in verschillende Oracle MySQL-producten en versies.
Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise
De kwetsbaarheden in Oracle PeopleSoft Enterprise PT PeopleTools versies 8.61 en 8.62 stellen ongeauthenticeerde aanvallers met netwerktoegang via HTTP of HTTPS in...
Kwetsbaarheden verholpen in Oracle VM VirtualBox
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle VM VirtualBox versie 7.2.8.
Kwetsbaarheden verholpen in Oracle Enterprise Manager
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Enterprise Manager versies 13.5 en 24.1.
Kwetsbaarheden verholpen in Oracle E-Business Suite producten
Oracle heeft kwetsbaarheden verholpen in diverse Oracle E-Business Suite producten, waaronder Oracle Enterprise Command Center Framework, iSupplier Portal, Complex Maintenance, Repair and Overhaul, Process Manufacturing Product Development, HR Intelligence, Receivables, Spares Management, Cost Management, Enterprise Asset Management, Applications Manager...
Kwetsbaarheden verholpen in Oracle Communications
Oracle heeft de updates verwerkt in de eigen software.
⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
This week’s recap covers exploited flaws, supply chain attacks, phishing kits, AI lures, macOS stealers, urgent CVEs, tools, and webinars.
Part of the PlainSec briefing for 2026-06-11