On this page · 8 sections
Summary. Oracle's July 2026 Critical Patch Update, released on 21 July 2026, is its largest ever: more than 1,400 new security patches across 32 product families, including 410 for E-Business Suite and 355 for Fusion Middleware, of which 219 are remotely exploitable without authentication. Ten flaws scored a perfect 10.0 on CVSS, all reachable over HTTP with no login, a first for a single Oracle quarter. The release also carries the permanent fix for PeopleSoft PeopleTools CVE-2026-35273, an unauthenticated server-side request forgery leading to remote code execution (CVSS 9.8) that attackers exploited as a zero-day from 27 May 2026, two weeks before Oracle's out-of-band alert on 10 June 2026. No security team patches 1,400 items at once. With the global average data breach at $4.99 million in 2026 and $11.5 million in the United States, the question is order, not effort. This guide gives a triage model that ranks fixes by trust boundary and exposure, not by product name.
The instinct after a record Critical Patch Update (CPU) is to sort by product and start at the top of your inventory. That is the wrong first move. The fastest way to mis-prioritise this release is to patch by product logo instead of by trust boundary, because the components an attacker can actually reach do not line up with the product tabs in Oracle's advisory.
What shipped, and why the count is contested
Different trackers report different totals, which matters when you brief leadership. Oracle's own advisory and blog describe the release as its largest ever, with more than 1,400 new patches. Tenable counts 1,235 unique CVEs. Both are correct: a single CVE can span several products, so a patch count runs higher than a CVE count. Use the CVE number for risk tracking and the patch number for effort planning.
The distribution is what guides triage. E-Business Suite took 410 patches, roughly 28 percent of the release. Fusion Middleware took 355, with 219 exploitable remotely without authentication. The ten CVSS 10.0 vulnerabilities all sit in internet-facing middleware: Access Manager, WebLogic Server Proxy Plug-in, Oracle Coherence, HTTP Server, Data Integrator, Platform Security for Java, WebCenter Content, and Service Delivery Platform. Two of them, CVE-2026-21962 and CVE-2026-60365, hit the same HTTP Server and WebLogic Proxy Plug-in surface, and a related WebLogic takeover flaw, CVE-2026-60206, scored 9.9. If you run WebLogic at the edge, these are the first things an internet scanner will find.
The real emergency: the PeopleSoft zero-day
CVE-2026-35273 is the item that should override your change calendar. It is a flaw in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools, rated 9.8, remotely exploitable without authentication, and confirmed as remote code execution by the vendor. TrendAI's Zero Day Initiative reported it, and Oracle shipped an out-of-band patch the same day as its 10 June 2026 alert. Mandiant confirmed exploitation in the wild between 27 May and 9 June 2026, and the CVE was added to the CISA Known Exploited Vulnerabilities catalog on 12 June 2026.
The campaign is attributed to UNC6240, the extortion group known as ShinyHunters, and it was not opportunistic spray. Per Mandiant's analysis, 68 percent of the more than 100 notified organisations were universities and colleges, with exploitation aimed at PeopleSoft's Environment Management Hub (PSEMHUB) endpoints. Rapid7's Jonah Burgess, in the company's Emergent Threat Response analysis, is direct about the timeline: organisations running PeopleTools 8.61 or 8.62 "should apply the vendor-supplied patch on an emergency basis, without waiting for a regular patch cycle to occur."
Patching alone is not enough here, because exploitation began before the fix existed. If you run affected PeopleTools versions, assume possible compromise and add three compensating controls: disable the Environment Management Hub in multi-server setups (or remove PSEMHUB in single-server ones), block external access to the /PSEMHUB/ and /PSIGW/HttpListeningConnector paths at the perimeter, which Mandiant notes is non-breaking for normal browser sessions, and monitor outbound SMB traffic on TCP port 445 for the NetNTLM-hash capture the exploit chain attempts. The July CPU also addresses a second critical PeopleSoft remote code execution flaw, CVE-2026-35278, so treat the PeopleSoft estate as one urgent unit.
The triage principle: trust boundary, not product logo
Here is the operational core. Sort every fix by how an attacker reaches the component, then by whether it is already under attack. That produces four tiers with clear service-level targets.
| Tier | What belongs here | Examples from this CPU | Patch target |
|---|---|---|---|
| 0. Exploited in the wild | Known-exploited, internet-reachable | PeopleSoft CVE-2026-35273 (PSEMHUB) | Immediate, out of cycle |
| 1. Internet-reachable, unauthenticated | No login needed, exposed to the internet | Ten CVSS 10.0 middleware; WebLogic CVE-2026-21962, CVE-2026-60365 | Within 72 hours |
| 2. Trusted core | High-value but internal only | Database Server, internal EBS and Fusion Middleware | Within 10 days |
| 3. Everything else | Low exposure or low impact | Client tools, low-severity components | By risk before the October 2026 CPU |
| Shared components | Underlying versions patched via other tabs | Database and Fusion Middleware under EBS | Patch with the parent, verify twice |
The last row is the trap. Oracle's own advisory concedes that E-Business Suite exposure sits partly in underlying Database and Fusion Middleware versions outside the E-Business Suite patch matrix. A team that patches "E-Business Suite" from the EBS tab and stops can leave the shared Database and middleware components that actually carry the risk unpatched. Map the shared components once, then verify them against both product tabs. This is the same discipline we apply in a broader corporate IT compliance audit, where control coverage, not tool inventory, is the unit of measurement.
What to patch first
If you own an Oracle estate, this is the concrete order for the first ten days.
| Priority | Component | Key CVE(s) | Why it is first |
|---|---|---|---|
| 1 | PeopleSoft PeopleTools 8.61 / 8.62 | CVE-2026-35273, CVE-2026-35278 | Active exploitation; unauthenticated RCE |
| 2 | WebLogic Server / HTTP Server Proxy | CVE-2026-21962, CVE-2026-60365 | CVSS 10.0, unauthenticated, internet-facing |
| 3 | WebLogic Server | CVE-2026-60206 | CVSS 9.9 takeover flaw |
| 4 | Access Manager, Coherence, WebCenter | Multiple 10.0 | Unauthenticated over HTTP |
| 5 | E-Business Suite + shared DB/FMW | 410 patches | Largest surface; shared-component risk |
Automate the discovery step. An accurate inventory of which PeopleTools, WebLogic, and Database versions you actually run, and which are internet-reachable, is worth more than any single patch, and it is the input every tier above depends on. The same rank-by-exposure logic applied to last week's Microsoft release is covered in our July 2026 Patch Tuesday enterprise triage, and the SharePoint remote code execution response in the SharePoint CVE-2026-45659 patch guide.
India-specific considerations
For Indian enterprises, two obligations sharpen the timeline. Under the Digital Personal Data Protection Act 2023 (DPDP), a breach of personal data triggers notification duties, so a PeopleSoft HR system, which holds exactly that data, moves up your priority list on legal grounds, not only technical ones. CERT-In's six-hour incident-reporting rule also applies, which means detection and response for the PeopleSoft campaign must be ready before you finish patching. Budget matters too: with the 2026 global average breach at $4.99 million, the cost of an emergency patch weekend is small against the downside. Where credential and identity hardening is part of the fix, our Kerberos RC4 enforcement remediation notes carry over, and MCP and API exposure is covered in MCP server hardening.
FAQ
How eCorpIT can help
eCorpIT is a Gurugram-based, ISO 27001:2022 certified engineering organisation. Our senior teams help enterprises turn a record Critical Patch Update into an ordered plan: inventory which Oracle versions you run and which are internet-reachable, triage by trust boundary, and stand up the compensating controls the PeopleSoft campaign demands, with data handling designed aligned with DPDP Act 2023 and CERT-In requirements. If you need the July 2026 CPU triaged and closed before the October release, talk to our team.
References
_Last updated: 2 August 2026._
