Oracle Critical Patch Update, August 2026: one exploited Identity Manager flaw in 390 fixes

The release at a glance

Oracle released the Critical Security Patch Update Advisory for August 2026, covering 390 CVEs in scope. The severity mix is 84 critical, 247 high, 56 medium and 3 low. Oracle Fusion Middleware accounts for 261 of the listed CVEs, followed by Oracle E-Business Suite with 120, Oracle Database Server with 5, and Oracle Java SE with 4.

One CVE is already in CISA KEV and assessed as active by CISA SSVC: CVE-2025-61757 in the Oracle Identity Manager REST WebServices component, published on 2025-10-21. The KEV due date is 2025-12-12. No other CVE in the release is listed as exploited.

What matters most

Oracle Identity Manager. CVE-2025-61757 is the priority. It is an unauthenticated HTTP flaw in REST WebServices affecting 12.2.1.4.0 and 14.1.2.1.0, with CVSS 9.8 and takeover of Identity Manager. CISA KEV and CISA SSVC both assess it as active, and its EPSS is 88.6. The KEV due date is 2025-12-12.

Two further Identity Manager flaws belong on the first pass: CVE-2026-60720 and CVE-2026-61066, both CVSS 9.9, affect OIM Legacy UI through HTTP and RMI respectively, require low privilege, and allow takeover of Identity Manager.

Oracle Internet Directory. CVE-2026-61241 is a CVSS 10.0 flaw. An unauthenticated attacker with network access via LDAP can take over Oracle Internet Directory; affected versions are 12.2.1.4.0 and 14.1.2.1.0. CVE-2026-61248 is an additional OID LDAP flaw requiring low privilege and rated CVSS 9.9.

Oracle WebLogic Server. CVE-2026-60702 is a CVSS 9.9 flaw reachable over T3 or IIOP by a low-privileged attacker, allowing takeover across affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

Oracle WebCenter Enterprise Capture. CVE-2026-60916 is unauthenticated over HTTP and allows unauthorised data changes, partial read and partial denial of service.

Oracle Managed File Transfer. CVE-2026-61003 is a CVSS 9.9 low-privilege takeover flaw reachable over T3 or IIOP.

Patch in this order

1. CVE-2025-61757 — Oracle Identity Manager (REST WebServices). Apply the vendor fix or mitigations first. CISA KEV and CISA SSVC rate it active; the KEV due date is 2025-12-12. Affected versions: 12.2.1.4.0, 14.1.2.1.0.
2. CVE-2026-61241 — Oracle Internet Directory. Unauthenticated LDAP takeover with CVSS 10.0. Prioritise for any internet-facing OID LDAP server. Affected versions: 12.2.1.4.0, 14.1.2.1.0.
3. CVE-2026-60916 — Oracle WebCenter Enterprise Capture. Unauthenticated HTTP with scope change. Prioritise if exposed. Affected versions: 12.2.1.4.0, 14.1.2.0.0.
4. CVE-2026-60702 — Oracle WebLogic Server. Low-privilege T3/IIOP takeover; prioritise especially if T3/IIOP is exposed. Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0.
5. CVE-2026-61248 — Oracle Internet Directory; CVE-2026-60720 and CVE-2026-61066 — Oracle Identity Manager; CVE-2026-61003 — Oracle Managed File Transfer. Low-privilege takeover flaws rated CVSS 9.9. Apply after the unauthenticated items.
6. Remaining Critical Patch Update. Complete the wider release: 84 critical and 247 high ratings among the 390 CVEs. Prioritise Fusion Middleware and E-Business Suite, then Database Server and Java SE.

Beyond the patch

A release this size is easier to handle next month if Oracle's exposure is already mapped. Virtual CISO Services (vCISO) helps identify internet-facing Oracle services, open T3/IIOP or LDAP ports, and middleware that does not need to be reachable. Where those products are already deployed, Implementation & Assessment Services provides penetration testing and hardening verification so a patch is confirmed to close the path rather than just being applied.