Vulnerabilities

Oracle August 2026 CPU ships 943 patches, including critical unauthenticated flaws in Fusion Middlew

Source: Badtech.org Vulnerabilities

Oracle released its August 2026 Critical Security Patch Update on August 18 with 943 new patches across its enterprise software portfolio, including 262 for Fusion Middleware, 120 for E-Business Suite, and 66 for Commerce. Covered products include WebLogic Server, PeopleSoft Enterprise PeopleTools, Oracle Internet Directory, Oracle Identity Manager, WebCenter, BI Publisher, Payments, Helidon, Hyperion, and Siebel Applications.

In Fusion Middleware, Oracle lists remotely exploitable unauthenticated flaws, including CVSS 10.0 issues in Oracle Internet Directory and CVSS 9.8 issues affecting WebLogic Server and other components. Oracle says customers should apply updates as soon as possible; temporary measures such as blocking required network protocols or removing unnecessary privileges may reduce risk but can impair functionality and are not long-term fixes.

IONIX separately describes CVE-2026-60821 as an unauthenticated remote-code-execution flaw in the Business Interlink component of PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. Oracle’s advisory also lists PeopleTools 8.61 through 8.63 among covered products.

Operational significance

Organizations should inventory affected Oracle deployments, prioritize internet-reachable Fusion Middleware and PeopleSoft systems, and apply product-specific patches and installation guidance. For exposed PeopleSoft PeopleTools systems, IONIX recommends prioritizing the fix for CVE-2026-60821 and restricting direct internet access until patching is complete.

Sources

Microsoft August Patch Tuesday includes exploited Windows privilege-escalation flaw and two publicly

Microsoft’s August 11 Patch Tuesday addressed hundreds of vulnerabilities across Windows, Office, Azure, Exchange Server, SharePoint, .NET, Teams, and other products. Qualys ThreatPROTECT and CyberHub Podcast counted 421 fixes, while other supplied coverage reported lower totals, with the difference attributed to counting method or update scope. The most urgent

Cisco patches critical Catalyst SD-WAN, IOS XE and Secure Firewall Management Center flaws

SecurityWeek reported that Cisco released fixes for roughly two dozen vulnerabilities across its products, including critical issues in Catalyst SD-WAN, IOS XE and Secure Firewall Management Center. For Catalyst SD-WAN, SecurityWeek and Secure ISS said Cisco identified CVE-2026-20303, CVE-2026-20304 and CVE-2026-20310 as

N-able N-central auth-bypass flaw is under active exploitation; customers told to verify 2026.3.1.7

N-able’s N-central RMM platform is under active exploitation through an authentication-bypass flaw, with Huntress reporting multiple affected organizations and observed follow-on activity including reconnaissance, process-list requests, and abuse of the Take Control remote-access feature on downstream hosts. N-central is a remote monitoring

Water utility cyber incidents across at least seven U.S. states disrupted monitoring and control across at least seven U.S. states

CBS News, NBC News, and CNN Newsource via KEYT reported that the FBI and EPA said water and wastewater utilities in at least seven U.S. states experienced malicious cyber incidents, with some activity degrading operations. The reporting says the activity targeted internet-facing programmable logic controllers, or PLCs, which