Oracle Releases July 2026 Critical Patch Update Advisory

Scheduled advisory includes 1449 security updates across multiple Oracle product families

Threat ID:: CC-4819
Threat Severity:: Medium
Published:: 22 July 2026 1:12 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled advisory includes 1449 security updates across multiple Oracle product families

Affected platforms

The following platforms are known to be affected:

Oracle E-Business Suite

Oracle Middleware

Oracle Communications

The following platforms are also known to be affected:

Multiple other Oracle product families. Please see Oracle's Critical Patch Update Advisory - July 2026 guide for full details.

Threat details

Introduction

Oracle has released the Critical Patch Update Advisory for July 2026 containing 1449 security updates. Of note is vulnerability CVE-2026-60880 (CVSSv3.1 score: 9.8) which, if exploited, could allow an unauthenticated remote attacker to takeover the Work in Process module in Oracle E-Business Suite.

Remediation advice

Affected organisations are encouraged to review Oracle Critical Patch Update Advisory - July 2026 and apply the relevant updates as soon as possible.

Definitive source of threat updates

https://www.oracle.com/security-alerts/cpujul2026.html

CVE Vulnerabilities

Status Published

CVE-2026-60880

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in takeover of Oracle Work in Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Last edited: 22 July 2026 1:12 pm