Oracle Security Patch Updates – 22 July 2026

By /
  • 247/2026
  • Critical

Oracle released its critical patch updates for July 2026, containing 1449 new security patches across multiple affected Oracle products and third-party components.

The addressed vulnerabilities could allow the attacker to conduct denial-of-service (DoS) attacks, bypass security restrictions, perform cross-site-scripting (XSS), server-side-request-forgery (SSRF), and SQL injection attacks, obtain sensitive information, manipulate data, or execute arbitrary code, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Oracle Access Manager Gain Access Vulnerability (CVE-2026-60358):

  • CVSS: 10
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

2. Oracle WebLogic Server Proxy Plug-in Data Modification Vulnerability (CVE- 2026-60365):

  • CVSS: 10
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Data Manipulation
Vulnerabilities
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Oracle Advisory – July 2026

References