Highlights

• Oracle’s July 2026 CPU ships 1,455 new security patches, the largest Critical Patch Update Oracle has issued to date.
• The highest score this quarter is a perfect CVSS 10.0, affecting Oracle Access Manager, WebLogic Server and Oracle Coherence within Fusion Middleware.
• PeopleSoft is the emergency priority. CVE-2026-35278 and CVE-2026-35273 (both CVSS 9.8) are under active exploitation by the ShinyHunters extortion group, which claims to have compromised more than 300 PeopleSoft servers across 100+ organizations since late May 2026.
• Fusion Middleware receives 359 patches (224 remotely exploitable without authentication), the largest single-family total in this CPU. WebLogic, Identity Manager and WebCenter Capture each carry CVSS 9.9 unauthenticated RCE flaws.
• E-Business Suite receives 416 patches (63 remotely exploitable), reflecting sustained attacker interest after the 2025 Cl0p campaign and a separately exploited flaw patched last month.
• Java SE ships 20 patches (18 remotely exploitable) with a comparatively modest maximum CVSS of 7.8, mostly affecting availability rather than confidentiality or integrity.
• Action: patch internet-facing PeopleSoft, Fusion Middleware (WebLogic, Identity Manager, Access Manager) and E-Business Suite this week. Treat the Database Server 9.9 flaw as high priority even though it is not yet reported under active exploitation.

Commentary

The Oracle Critical Patch Update (CPU) for July 2026 contains 1,455 new security patches spanning more than two dozen product families, making it the largest quarterly release Oracle has published. The update is cumulative, meaning it folds in the May 28 and June 16, 2026 monthly Critical Security Patch Updates (CSPU) as well as the out-of-band Security Alert issued June 10, 2026 for the PeopleSoft PeopleTools vulnerability now tracked as CVE-2026-35273.

Advisory scope: 257 CVE-product matrix entries across 66 products in 11 product families (251 unique CVEs; same CVE can appear in multiple matrices).

Top risk products (Critical CVEs)

Family-level highlights

Oracle Fusion Middleware is the dominant risk surface consisting of 69 Critical CVEs across 14 products, 49 of them remotely exploitable without authentication. The WebCenter stack alone (Content, Portal, Sites, Enterprise Capture, Imaging) accounts for 47 Critical vulnerabilities. Oracle Coherence stands out with 7 Critical CVEs all scoring 9.3–10.0 and all RNoAuth.

DUBLIN - 15 June, 2026 - Waratek, the leader in runtime application security, today announced the appointment of Apostolos Giannakidis as Chief Technology Officer. In his new role, Giannakidis will lead Waratek’s technology vision, product strategy, and security research as the company expands its runtime protection platform to address the surge in software vulnerabilities and exploits introduced by AI-generated code.

–URGENT ACTION RECOMMENDED–

For Waratek customers and prospects

Highlights

• Oracle has moved from quarterly to monthly & quarterly security patching. The first Critical Security Patch Update (CSPU) shipped on Thursday, May 28, 2026; subsequent CSPUs land on the third Tuesday of each month outside the quarterly CPU window.
• This first CSPU is targeted and compact: 35 new security patches across five product families – a deliberately smaller footprint than the 483-patch April CPU.
• Headline severity is a CVSS 10.0 in Oracle REST Data Services (ORDS) – the maximum possible score, unauthenticated, network-exploitable.
• Oracle E-Business Suite ships 12 patches with a max CVSS 9.9 – attacker focus on EBS remains high after October 2025’s Cl0p extortion campaign (CVE-2025-61882).
• Action: Waratek customers should contact customersuccess@waratek.com for RASP rule coverage; prospects can request a same-week protection assessment from sales@waratek.com.

What Changed: Oracle’s New Monthly Cadence

For more than two decades Oracle has shipped security fixes on a quarterly Critical Patch Update (CPU) rhythm. As of May 28, 2026, Oracle has introduced an additional, monthly Critical Security Patch Update (CSPU) stream that fills the gap between quarterly releases. The change is a direct response to a year in which Oracle products were targeted by ransomware operators (Cl0p / CVE-2025-61882) and Identity Manager flaws (CVE-2025-61757, CVE-2026-21992) reached CISA’s KEV catalog within days of disclosure.

REDWOOD SHORES, Calif. - March 18, 2026 - Waratek, a leader in next-generation application security, today announced the official launch of Waratek IAST (Interactive Application Security Testing). The announcement was made during the JavaOne 2026 conference, where Waratek CEO Doug Ennis delivered a featured session on securing the software development lifecycle (SDLC) in the age of AI-generated code.

The launch addresses a critical and growing risk for enterprises relying on Large Language Models (LLMs) to accelerate Java development. While AI boosts productivity, new data from industry leaders reveals that this increased code volume comes with a significant security trade-off, specifically for the Java language.

We’re thrilled to share that Waratek has been included in the Ireland INC US 250 Index 2024, a special report curated by Business & Finance Magazine which showcases 250 leading Irish companies that are actively investing in the United States. This annual index highlights the contributions of Irish companies that are driving economic growth, creating jobs, and fostering innovation across the Atlantic.

The Ireland INC US 250 Index celebrates a remarkable year of growth in Irish foreign direct investment (FDI) in the US. As of 2023, Irish companies have invested a record $240 billion in the US economy. The impact of this investment is far-reaching, with nearly 100,000 US workers employed by the US affiliates of Irish-owned companies and a presence in over 2,200 locations across the country. Approximately 900 Irish companies export to the US, supporting vital industries across technology, healthcare, financial services, and more.