Oracle Releases 245 New Security Patches, All Rated ‘High-Priority Security’

Why It Matters

These high‑priority fixes address remote‑code‑execution bugs that are already being weaponized, meaning unpatched enterprises face immediate ransomware and data‑theft risk. The volume and unauthenticated nature of the flaws also pressure organizations to accelerate patching cycles and reconsider legacy product lifecycles.

Key Takeaways

• Oracle released 245 high‑priority patches across 10+ product families.
• 106 fixes target Fusion Middleware; 53 are unauthenticated remote exploits.
• PeopleSoft CVE‑2026‑35273 exploited in the wild demands immediate patching.
• WebLogic and Coherence contain CVSS 10.0 flaws without authentication.
• Extended Fusion Middleware support runs through Dec 2027, but end‑of‑life risk remains.

Pulse Analysis

Oracle’s June 2026 Critical Security Patch Update marks a shift from its traditional quarterly cadence to a more aggressive, high‑priority release model. The 245 patches arrive in response to a broader industry push for faster remediation of zero‑day flaws, a trend accelerated by the rise of AI‑driven threat actors that can weaponize vulnerabilities within days. By bundling fixes into a focused, out‑of‑band alert, Oracle aims to reduce the operational friction of large quarterly updates, allowing customers to apply only the most urgent patches with minimal downtime. This approach mirrors moves by other vendors to deliver “micro‑patches” that keep pace with the velocity of modern cyber‑attacks.

The most alarming entries in the bulletin are the CVSS 10.0 vulnerabilities in WebLogic Server and Oracle Coherence, both exploitable without any authentication. WebLogic has long been a ransomware favorite, and its unauthenticated console access opens a direct path to enterprise networks. Coherence, a shared caching layer, sits beneath many application stacks, turning a single breach into a pivot point across multiple systems. Equally urgent is PeopleSoft PeopleTools CVE‑2026‑35273, which attackers are already exploiting in the wild to compromise HR, finance and student information systems. These flaws combine remote reach, lack of credential checks, and privileged placement, creating a perfect storm for attackers.

For organizations, the patch surge underscores the need to rethink legacy maintenance and support strategies. While Oracle extends Fusion Middleware support through December 2027, the high concentration of remote exploits in that product line suggests a shrinking window for safe operation. Enterprises should prioritize rapid testing and deployment of the unauthenticated patches, leverage compensating controls such as network segmentation, and accelerate migration away from end‑of‑life components. Investing in automated patch management and continuous vulnerability monitoring can shrink the gap between advisory release and remediation, turning Oracle’s proactive patching cadence into a tangible reduction in breach risk.