Highlights
- Oracle’s October 2026 CPU ships 1,295 new security patches, down from the record 1,448 in July (as updated in August) but still more than double the 481 patches in April 2026.
- Six vulnerabilities carry a perfect CVSS 10.0, all remotely exploitable without authentication: Oracle Access Manager, three in Oracle SOA Suite, the E-Business Suite Workflow Notification Mailer and the JD Edwards EnterpriseOne Orchestrator.
- PeopleSoft remains an active emergency. ShinyHunters relaunched mass exploitation of CVE-2026-35273 (CVSS 9.8) in late September, bypassing the WAF rules that many organizations deployed in place of the June patch. Google has notified more than 100 affected organizations. Waratek runtime rules protect PeopleSoft users against these attacks.
- Fusion Middleware receives 206 patches (134 remotely exploitable without authentication), the largest total of any family this quarter. WebLogic Server carries two unauthenticated 9.8 flaws over HTTP and T3/IIOP, and Identity Manager and Access Manager each add unauthenticated 9.8 issues.
- E-Business Suite receives 194 patches (31 remotely exploitable without authentication) with a 10.0 in Oracle Workflow and CVE-2026-101767, a 9.8 unauthenticated SQL injection that researchers say leads to remote code execution.
- Java SE ships 55 patches with a modest 7.5 top score, but 43 of them are reachable through Java APIs on servers, so many security risks sit under the middleware and ERP stacks.
- Oracle Hyperion: no Hyperion EPM product appears in this CPU, but Essbase receives 38 patches, including an unauthenticated 9.8 (CVE-2026-91665) and four 9.9 flaws that need only low privileges. The critical Hyperion Financial Reporting flaw CVE-2026-70740 (9.8) was fixed in the August CSPU and should be confirmed separately.
- Action: Protect PeopleSoft now with Waratek’s runtime rules and stop relying on WAF rules alone. Then address internet-facing Fusion Middleware (Access Manager, SOA Suite, WebLogic, Identity Manager), E-Business Suite, and Java SE.
Commentary
The Oracle Critical Patch Update (CPU) for October 2026 contains 1,295 new security patches across Oracle’s on-premises portfolio. It is the second quarterly CPU since Oracle introduced monthly Critical Security Patch Updates (CSPU) in May, and it follows the August and September CSPUs, the latter of which alone carried 673 new patches. The final count is slightly higher than the 1,283 patches Oracle described in its October 15 pre-release announcement, and the per-family totals shifted as well, so teams that sized their maintenance windows from the pre-release should recheck against the final advisory.
The headline risk this quarter sits in two places. First, the raw severity is concentrated in Fusion Middleware and E-Business Suite, which between them account for 400 patches and five of the six CVSS 10.0 vulnerabilities. Second, the most urgent threat is not a new flaw at all.
CVE-2026-35273 in PeopleSoft PeopleTools was fixed in June, yet Google Threat Intelligence Group reported on September 25 that ShinyHunters had modified its exploit to get past WAF rules that block the vulnerable Environment Management Hub endpoint, and is now deploying web shells and a new backdoor on PeopleSoft servers that were mitigated but never patched.
Waratek’s runtime rules protect PeopleSoft users from the ShinyHunters attacks against CVE-2026-35273, including the renewed campaign that defeats WAF-only mitigations. For the rest of this CPU, not every CVE is immediately exploitable in every environment, and existing runtime rules may already address some of them. Waratek customers should contact Customer Success to determine whether their current rules cover specific CVEs in this release while their teams work through patch prioritization.
We are not aware of public reports that any vulnerability newly fixed in this CPU has been exploited in the wild as of publication. That status tends to change quickly for Oracle middleware and ERP products: CVE-2026-21962, a CVSS 10.0 flaw in Oracle HTTP Server and the WebLogic Proxy Plug-in patched in January, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in August after a public proof of concept appeared. Security teams should sequence their work by exploitation status first, then by unauthenticated network exposure and CVSS score.
Critical CVSS Summary (Score 9.0+)
The vulnerabilities below carry a CVSS base score of 9.0 or higher and are remotely exploitable over the network without authentication. The first row is a previously patched flaw included because it is under active exploitation now. All other rows are newly fixed in the October 2026 CPU.
| CVE ID | CVSS | Affected Product Families | Vulnerability / Impact |
|---|---|---|---|
| CVE-2026-35273 | 9.8 | PeopleSoft PeopleTools (Environment Management Hub) | Prior fix (June 2026 Security Alert). Unauthenticated RCE under renewed ShinyHunters exploitation that bypasses WAF-only mitigations. Listed in CISA KEV. |
| CVE-2026-87337 | 10.0 | Fusion Middleware / Access Manager (Authentication Engine) | Unauthenticated compromise over HTTP. Access Manager fronts single sign-on, so exposure extends to the applications it protects. |
| CVE-2026-91231 | 10.0 | Fusion Middleware / SOA Suite (Adapters) | Unauthenticated compromise over HTTP. |
| CVE-2026-91216 / CVE-2026-91221 | 10.0 | Fusion Middleware / SOA Suite (Fabric Layer) | Unauthenticated compromise over the T3 and IIOP protocols. |
| CVE-2026-101809 | 10.0 | E-Business Suite / Oracle Workflow (Workflow Notification Mailer) | Highest EBS score this cycle. Unauthenticated compromise over HTTP. |
| CVE-2026-91299 | 10.0 | JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security) | Unauthenticated compromise over HTTP. |
| CVE-2026-101767 | 9.8 | E-Business Suite / Application Object Library (Core) | Unauthenticated SQL injection leading to RCE, reported to Oracle by Horizon3 in July 2026. |
| CVE-2026-91323 / CVE-2026-83399 | 9.8 | Fusion Middleware / WebLogic Server (Core) | Unauthenticated compromise over HTTP (91323) and T3/IIOP (83399). A third Core flaw, CVE-2026-87302, is rated 9.1. |
| CVE-2026-87251 | 9.8 | Fusion Middleware / Access Manager (Authentication Engine) | Unauthenticated compromise via SAML. |
| CVE-2026-91408 / CVE-2026-91491 | 9.8 | Fusion Middleware / Identity Manager and Identity Manager Connector | Unauthenticated compromise over T3/IIOP (End User Self Service) and LDAP (LDAP Gateway). |
| Multiple | 9.8 | Fusion Middleware / SOA Suite, BPM Suite, WebCenter Content and Sites, Data Integrator, Managed File Transfer | More than a dozen further unauthenticated 9.8 flaws, several in bundled Apache Mina and other third-party libraries. |
| CVE-2026-33466 | 9.8 | PeopleSoft PeopleTools (Logstash) | Highest new PeopleSoft score. Third-party Logstash component; the patch also addresses a long list of bundled CVEs. |
| CVE-2026-75803 | 9.8 | Oracle Database Server (RDBMS, OpenSSL) | Third-party OpenSSL flaw reachable over TLS. Not reported exploited as of publication. |
| CVE-2026-91665 / CVE-2026-91644 | 9.8 | Oracle Essbase (Security) | Unauthenticated compromise over TCP (91665) and HTTP (91644, rated 9.3). Essbase is the only Hyperion-lineage product in this CPU. |
| Multiple | 9.8 | Communications, MySQL, Systems, APEX, Secure Backup, HealthCare | Unauthenticated network flaws, most of them in bundled third-party components. |
| CVE-2026-101634 / CVE-2026-101808 | 9.1 | E-Business Suite / Mobile Field Service and Product Workbench | Unauthenticated network flaws over HTTP. |
A second group of flaws rated 9.6 to 9.9 requires only a low-privileged account. These include six 9.9 issues in SOA Suite, BPM Suite and Outside In Technology, a 9.6 in the Oracle HTTP Server OSSL module, a 9.6 in PeopleSoft SQR (CVE-2026-101420), and 9.9 issues in Essbase, Enterprise Manager, Siebel CRM and Trusted Answer Search. Any of these becomes critical if an attacker already holds a foothold or valid credentials.
Focus Area: Key Product Families
Oracle Fusion Middleware
Fusion Middleware received 206 new security patches, the largest total of any family in this CPU, with 134 remotely exploitable without authentication. Roughly 30 of its risk matrix entries combine a score of 9.0 or higher with no authentication requirement.
- Highest severity: four CVSS 10.0 flaws. CVE-2026-87337 in the Oracle Access Manager Authentication Engine is reachable over HTTP. Three more sit in Oracle SOA Suite: CVE-2026-91231 (Adapters, HTTP) and CVE-2026-91216 and CVE-2026-91221 (Fabric Layer, T3/IIOP).
- WebLogic Server: CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3/IIOP) are both unauthenticated 9.8 flaws in the Core component, and CVE-2026-87302 adds a 9.1. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. WebLogic has been a repeat target this year, with CISA adding CVE-2024-21182 to KEV in June and CVE-2026-21962 (Oracle HTTP Server and WebLogic Proxy Plug-in) in August.
- Identity tier: Access Manager also carries CVE-2026-87251 (9.8, SAML), Identity Manager carries CVE-2026-91408 (9.8, T3/IIOP), and the Identity Manager Connector LDAP Gateway carries CVE-2026-91491 (9.8) and CVE-2026-91490 (9.1). Identity Manager already needed an out-of-band fix in March for CVE-2026-21992, so internet-reachable OAM and OIM endpoints should be patched first.
- Operational risk: T3 and IIOP remain the protocols most associated with Java deserialization attacks on Oracle middleware. Where patching will take time, restrict T3/IIOP to trusted hosts at the network edge as a temporary measure.
- Dependency warning: E-Business Suite, PeopleSoft and other Oracle applications run on these middleware components, so the Fusion Middleware fixes apply to those stacks as well.
Oracle PeopleSoft, active exploitation
PeopleSoft received 109 new security patches, with 41 remotely exploitable without authentication and a highest CVSS of 9.8. The new fixes matter, but the more pressing issue is the renewed campaign against a flaw Oracle fixed four months ago.
- CVE-2026-35273 (CVSS 9.8) is an unauthenticated RCE in the PeopleTools Environment Management Hub. Mandiant and Google Threat Intelligence Group traced zero-day exploitation by ShinyHunters back to May 27, 2026, and Oracle issued an out-of-band Security Alert on June 10. CISA added it to the KEV catalog two days later.
- Renewed campaign: on September 25, Google reported that ShinyHunters (tracked as UNC6240) had modified its exploit to get around WAF rules blocking the PSEMHUB endpoint. The group is deploying web shells and a new Windows backdoor, SIDEEYE, and victims now span technology, healthcare, transportation, agriculture and government as well as higher education. Organizations that mitigated in June without patching should assume they are being targeted.
- CVE-2026-35278, fixed in the June CSPU, was claimed by ShinyHunters at the time to be chained with CVE-2026-35273 in the same intrusions, though this has not been independently confirmed. Confirm both fixes are present.
- New in this CPU: CVE-2026-33466 (9.8, PeopleTools Logstash, unauthenticated over HTTP) is the top new score. CVE-2026-101420 (9.6, SQR) needs low privileges, and several unauthenticated 8.x issues affect Report Distribution, File Processing (libssh2) and Business Interlink. PeopleTools 8.61 through 8.63 are in scope.
- Waratek protection: Waratek’s runtime rules protect PeopleSoft users from ShinyHunters’ attacks against CVE-2026-35273. Unlike the WAF rules the group has learned to bypass, this protection does not depend on blocking the PSEMHUB endpoint at the network edge. Customers should still plan to apply Oracle’s patch and investigate for prior compromise.
- Response: apply the patches, then investigate. Google recommends inspecting PeopleSoft servers for web shells and the SIDEEYE backdoor, rotating exposed credentials and hunting for the campaign’s network indicators.
Oracle E-Business Suite (EBS)
EBS received 194 new security patches this cycle, with 31 remotely exploitable without authentication and a highest CVSS of 10.0. Affected releases are 12.2.3 through 12.2.15.
- CVE-2026-101809 (CVSS 10.0) affects the Workflow Notification Mailer in Oracle Workflow and is exploitable over HTTP without authentication.
- CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Core component of Oracle Application Object Library, affecting EBS 12.2.3 through 12.2.15. Horizon3 reported it to Oracle on July 24 and has since published technical details showing how it chains to remote code execution:
- Send an unauthenticated request to the Thin Client Framework (TCF) servlet at
/OA_HTML/AppsTCFServer - Inject SQL that runs as the APPS database user
- Use that access to execute operating system commands as the EBS application account
- Send an unauthenticated request to the Thin Client Framework (TCF) servlet at
The impact covers both data and host. APPS is the schema owner EBS uses to reach data across all its modules, so an attacker can read or modify financial, payroll, HR and procurement records. On the application host, commands run with the permissions of the EBS application account.
Public technical detail on a flaw like this usually shortens the time before attackers follow. And this is not only an internet-perimeter problem: anyone who can reach the TCF servlet, including from inside the network, can attempt the chain. Restricting internet access reduces exposure, but only the patch removes it.
- Two more unauthenticated flaws score 9.1: CVE-2026-101634 (Mobile Field Service) and CVE-2026-101808 (Product Workbench WebUI). Most of the remaining 190 EBS fixes fall in the 7.0 to 8.9 range and require some level of access.
- History: EBS has seen repeated attacker interest, from the 2025 Cl0p campaign (CVE-2025-61882) to CVE-2026-46817 in Oracle Payments, which CISA added to KEV on July 15, 2026 after exploitation of unpatched systems.
- Dependency warning: EBS exposure also depends on its Oracle Database and Fusion Middleware components. Oracle recommends applying the October CPU to those layers as well (My Oracle Support Note KA923).
Oracle Java SE
Java SE contains 55 new security patches this cycle, with 49 remotely exploitable without authentication. The highest CVSS is 7.5, and 52 of the 55 fixes score below 7.0.
- Top entries: CVE-2026-43660 (7.5) in JavaFX (WebKitGTK), which is network-reachable but requires high attack complexity and user interaction, and CVE-2026-91484 (7.5) in the Java plugin, which requires local access. CVE-2026-91415 (7.0, 2D) and CVE-2026-91398 (6.8, Networking over SOCKS5) follow.
- Scoring context: Oracle scores Java SE assuming the user runs with administrator privileges. On typical Linux and Solaris server deployments the effective scores are lower.
- Affected versions include Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27, plus GraalVM for JDK and GraalVM Enterprise Edition. No Java SE flaw in this CPU has been reported as exploited. Patch on a normal cycle, giving priority to client systems that run JavaFX content or connect through SOCKS proxies.
Oracle Hyperion and Essbase
No product carrying the Hyperion name appears in the October CPU. The only Hyperion-lineage product is Oracle Essbase 21.8.3.0.0, which Oracle now lists under the Database product family. Essbase received 38 new security patches, with 14 remotely exploitable without authentication and a highest CVSS of 9.9. Eight of the 38 score 9.0 or higher, and most of the fixes sit in the Essbase Security component.
- Unauthenticated flaws: CVE-2026-91665 (9.8, over TCP) and CVE-2026-91644 (9.3, over HTTP) need no credentials and should lead the Essbase work. Other unauthenticated issues include CVE-2026-91635 (8.1, T3/IIOP) and CVE-2026-91647 (8.1, TCP), both rated high attack complexity, along with CVE-2026-91664 (7.5, TCP), CVE-2026-54428 (7.5, Apache HttpComponents over HTTP/2) and CVE-2026-91642 (7.3, HTTP).
- Low-privilege 9.9 flaws: CVE-2026-91637, CVE-2026-91638 and CVE-2026-91658 (HTTP) and CVE-2026-91663 (T3/IIOP) require only a low-privileged account, and CVE-2026-91656 (Federated Partitions) and CVE-2026-91655 score 9.1 on the same basis. Essbase usually serves a large population of finance and planning users, so a low privilege requirement offers limited protection.
- Hyperion EPM fixes arrived through the monthly CSPUs. The August 18, 2026 CSPU fixed Hyperion Financial Reporting, Financial Management and Data Relationship Management issues in release 11.2.25, including CVE-2026-70740, an unauthenticated 9.8 takeover of Hyperion Financial Reporting over HTTP. The September 15 CSPU added further Hyperion Financial Management fixes for 11.2.26, such as CVE-2026-87250. Because the October advisory does not list Hyperion EPM products, teams that track only the quarterly CPU should check the Hyperion Patch Availability Document to confirm those monthly fixes are installed.
- Exploitation: we found no public reports of exploitation for the Essbase or Hyperion EPM flaws, and CVE-2026-70740 was not listed in CISA KEV as of our last check.
- Dependency warning: Essbase and Hyperion EPM 11.2 run on WebLogic Server, so the Fusion Middleware fixes in this CPU apply to those deployments as well. Restricting T3/IIOP to trusted hosts also reduces exposure to the Essbase T3/IIOP flaws.
Other affected families
- JD Edwards: 102 patches, 44 remotely exploitable, highest CVSS 10.0 (CVE-2026-91299, EnterpriseOne Orchestrator, unauthenticated over HTTP).
- Oracle Communications: 110 patches, 77 remotely exploitable, highest CVSS 9.8, mostly in bundled third-party libraries across Cloud Native Core components.
- Siebel CRM: 122 patches, 66 remotely exploitable, highest CVSS 9.9 (authenticated).
- MySQL: 98 patches, 29 remotely exploitable, highest CVSS 9.8.
- Oracle Database Server: 14 patches, 4 remotely exploitable, highest CVSS 9.8 (OpenSSL over TLS) across 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Not reported exploited as of publication.
- Enterprise Manager: 12 patches, highest CVSS 9.9, requiring low privileges. Oracle Systems: 28 patches, highest CVSS 9.8.
Threat Intelligence: Active Attacks and Zero-Days
PeopleSoft is again the clear emergency, even though the vulnerable code was patched in June. The renewed ShinyHunters campaign shows a group adapting to published defensive guidance and going after organizations that treated a WAF rule as a fix. Google reported that dozens of systems worldwide already have web shells, and ShinyHunters has claimed new high-profile victims through PeopleSoft in recent weeks.
Previously patched Oracle flaws continue to be exploited across the portfolio. Organizations should confirm the following fixes are in place alongside the October CPU.
| CVE ID | CVSS | Affected Product Families | Exploitation Status |
|---|---|---|---|
| CVE-2026-35273 | 9.8 | PeopleSoft PeopleTools | Zero-day since May 27, 2026. Renewed mass exploitation reported September 25 that bypasses WAF mitigations. CISA KEV. |
| CVE-2026-35278 | 9.8 | PeopleSoft PeopleTools | Fixed in the June 2026 CSPU. ShinyHunters claimed to chain it with CVE-2026-35273; not independently confirmed or listed in CISA KEV. |
| CVE-2026-21962 | 10.0 | Oracle HTTP Server / WebLogic Proxy Plug-in | Fixed in January 2026. Added to CISA KEV on August 24, 2026 after a public proof of concept. |
| CVE-2026-46817 | 9.8 | E-Business Suite / Oracle Payments | Fixed in the May 2026 CSPU. Added to CISA KEV on July 15, 2026. |
| CVE-2024-21182 | 7.5 | WebLogic Server | Patched in 2024. Added to CISA KEV in June 2026. |
By contrast, the six CVSS 10.0 vulnerabilities in this release carry the highest theoretical severity but have no public exploitation reports yet. Given how quickly the January WebLogic Proxy Plug-in flaw and the May EBS Payments flaw moved to KEV, teams should expect the same for the most exposed of this quarter’s fixes once proof-of-concept code circulates.
Frequently Asked Questions
What is in the October 2026 CPU and how does it compare to July?
The October CPU contains 1,295 new security patches, compared with 1,448 in July. Fusion Middleware (206 patches) and E-Business Suite (194) are again the largest families, followed by Siebel CRM (122), Oracle Communications (110), PeopleSoft (109) and JD Edwards (102). July’s CVSS 10.0 issues were confined to Fusion Middleware. October has six 10.0 vulnerabilities across Fusion Middleware, E-Business Suite and JD Edwards.
How does Waratek help with the October 2026 CPU?
Waratek’s runtime rules protect PeopleSoft users from the ShinyHunters attacks against CVE-2026-35273. For other CVEs in this release, not every vulnerability may be immediately exploitable in a given environment, and existing runtime rules may already address some of them. Waratek customers should contact Customer Success to confirm which specific CVEs their current rules cover, so that patching can be prioritized around the gaps rather than rushed across every system at once.
Is anything in this CPU being actively exploited right now?
We are not aware of public reports that any vulnerability newly fixed in the October CPU has been exploited as of publication. The active threat is CVE-2026-35273 in PeopleSoft, fixed in June and now the target of a renewed ShinyHunters campaign. Previously fixed flaws in WebLogic, Oracle HTTP Server and E-Business Suite are also on the CISA KEV list.
We blocked the PeopleSoft EMHub endpoint with a WAF rule in June. Are we protected?
Not reliably. Google reported that ShinyHunters modified its exploit specifically to bypass WAF rules on the PSEMHUB endpoint and is targeting organizations that mitigated using WAFs without patching. Apply the CVE-2026-35273 fix, confirm the June fix for CVE-2026-35278 is present, and investigate for web shells, the SIDEEYE backdoor and credential exposure even after patching. Waratek customers are protected against these attacks by Waratek’s runtime rules.
Should we prioritize the CVSS 10.0 flaws or PeopleSoft first?
PeopleSoft first. Confirmed exploitation against real organizations outweighs a higher score with no known attacker activity. Internet-facing Fusion Middleware (Access Manager, SOA Suite, WebLogic, Identity Manager) and E-Business Suite should follow immediately, since both have unauthenticated 9.8 to 10.0 flaws and both have had vulnerabilities exploited in the past twelve months.
Which Fusion Middleware components should we patch first?
Start with anything reachable from the internet or from untrusted networks: Oracle Access Manager and Identity Manager endpoints, SOA Suite and BPM Suite services, WebLogic Server instances exposing HTTP or T3/IIOP, and WebCenter, Managed File Transfer and Data Integrator consoles. Restricting T3/IIOP to trusted hosts reduces risk while patches are tested but is not a substitute for patching. Waratek customers may already be protected by a Waratek RASP runtime rule. Confirm you are covered with Customer Success.
How urgent is the E-Business Suite update?
High. CVE-2026-101809 (10.0) and CVE-2026-101767 (9.8) are both unauthenticated over HTTP, and the researchers who found CVE-2026-101767 describe it as SQL injection leading to code execution. EBS has been exploited repeatedly since 2025, including CVE-2026-46817 earlier this year, so internet-facing EBS should be patched this week together with its Database and Fusion Middleware layers.
Is Java SE as urgent as the other product families this quarter?
Not as urgent as PeopleSoft or internet-facing Fusion Middleware, but the lack of critical CVEs in the Java SE should not deprioritize your patching efforts. Java SE is the runtime platform that all code paths execute. Apply the Java SE patches on a normal cycle, with earlier attention for internet-facing Java apps.
Are Oracle Hyperion products affected by this CPU?
Only Oracle Essbase, which Oracle now lists under the Database family. It receives 38 patches, including an unauthenticated 9.8 (CVE-2026-91665) and four 9.9 flaws that need a low-privileged account. Hyperion Financial Reporting, Financial Management and Data Relationship Management are not in the October advisory because their recent fixes shipped in the August and September CSPUs. If you run Hyperion EPM, confirm those monthly patches are installed, with CVE-2026-70740 (9.8, Financial Reporting) as the priority, and apply the Fusion Middleware fixes to the WebLogic layer underneath.
When is the next Oracle security release?
Oracle now releases security patches monthly. The next CSPUs are due November 17 and December 15, 2026, and the next quarterly CPU is due January 19, 2027.
For More Information
Full Oracle advisory: https://www.oracle.com/security-alerts/cpuoct2026.html
Google Threat Intelligence Group, renewed PeopleSoft campaign: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
This bulletin is a security news summary compiled from Oracle's published advisory and public reporting on active exploitation, with guidance for Waratek customers. It is not an official Oracle publication. Confirm patch applicability and installation steps against Oracle's own advisory and My Oracle Support documentation before deploying to production.
About Waratek
Waratek offers Waratek IAST+RASP, the only compiler-based, runtime application tools that find vulnerabilities in the pre-production development pipeline, block attacks in production, and virtually patch flaws with no downtime or source code changes. Waratek IAST watches code execute to identify security flaws with absolute certainty, eliminating the “guesswork” and alert fatigue associated with traditional scanners. Waratek RASP intercepts and terminates unsafe operations at the JVM level, stopping attempts to change app behavior in attacks aimed at known and Zero Day vulnerabilities. Waratek is a trusted partner for organizations in global financial services, hospitality, healthcare, technology and other industries. Waratek has offices in Dublin, Ireland and Chicago, Illinois.
