Oracle's July update fixes unauthenticated 10.0 code-execution flaws in WebLogic, HTTP Server, and Coherence

Oracle's July 2026 Critical Patch Update lands 1,449 new security fixes across its product line, one of the largest single releases the company has ever shipped. Most of that number is noise for any one operator: it spans PeopleSoft, Siebel, Retail, Communications, banking and hospitality suites that a typical server team never touches. Strip it down to the software people actually self-host, and a much smaller set demands attention this week, a cluster of flaws an unauthenticated attacker can trigger over the network for full remote code execution, several scored a perfect CVSS 10.0.

The flaws that rate a 10.0, and need no login

Oracle marks a vulnerability "remotely exploitable without authentication" when it can be reached over a network with no credentials at all. This update carries several at the maximum 10.0 score, all in middleware that commonly sits in front of applications:

• Oracle HTTP Server and the WebLogic Server Proxy Plug-in, CVE-2026-60365, CVSS 10.0, over HTTP.

• Oracle Coherence, CVE-2026-60217, CVSS 10.0, over TCP, alongside dozens more Coherence flaws at 9.8.

• Oracle Access Manager (CVE-2026-60358), Oracle Unified Directory (CVE-2026-60360), Oracle WebCenter Content (CVE-2026-60644), Oracle Platform Security for Java (CVE-2026-60366) and Oracle Data Integrator (CVE-2026-47056), each CVSS 10.0.

The Fusion Middleware family alone accounts for 355 of the fixes, and Oracle flags 219 of them as exploitable without authentication. That is the part of the release that turns a routine patch cycle into a same-week job for anyone exposing these services.

WebLogic and Coherence are the ones most likely pointed at the internet

If you run Oracle WebLogic Server, this update patches a run of unauthenticated remote-code-execution flaws scored 9.8, including CVE-2026-60199, CVE-2026-60291, CVE-2026-60200, CVE-2026-60198 and CVE-2026-60202, spread across its HTTP, T3, IIOP and SOAP surfaces. WebLogic has a long history of internet-facing mass exploitation through exactly those protocols, so an unpatched, reachable instance is the highest-priority item here. Oracle Coherence, frequently embedded in the same deployments, adds its own long list of 9.8 unauthenticated flaws over TCP and HTTP. The Oracle HTTP Server proxy plug-in flaw at 10.0 sits on the same path, since it is the component that fronts WebLogic for many stacks.

What is lower-urgency this round

Not every Oracle product in the update is a network emergency, and it is worth being honest about which are not:

• MySQL received 54 fixes, but the highest score is 8.5 and only nine are exploitable without authentication. Most sit in the connectors and router rather than the database engine itself, and the server-side issues generally need an authenticated session. Patch on your normal cycle, and prioritise any MySQL Router or connector that faces untrusted clients.

• Oracle Java SE got 19 fixes, but they mostly affect sandboxed applets and Web Start clients that load untrusted code. Oracle's own note says server deployments running only trusted code are largely unaffected, and the scores drop when Java is not running with administrator rights.

• Oracle VM VirtualBox had 16 fixes, and none are remotely exploitable without authentication. They are local guest-to-host escapes, which matter if you run untrusted virtual machines, but they are not an internet-facing risk.

How to tell if you are exposed, and what to watch while you patch

The gap between "a patch exists" and "the patch is applied" is where these get exploited, and Oracle notes it keeps seeing attacks on flaws it has already fixed, because the update was never installed. Two things close that gap. First, know your exposure: which of your hosts actually run WebLogic, Coherence, Oracle HTTP Server or the other affected components, and which of those are reachable from outside. A managed platform that tracks package and service inventory against the CVE feeds can tell you which machines a new advisory touches, instead of leaving you to guess host by host. Second, while the patch window is open, watch the middleware itself: unexpected requests to WebLogic's T3, IIOP or admin surfaces, new processes spawned by the application server, or files appearing under its web root are the signals that someone is trying the flaw before you have closed it. File integrity monitoring and log collection on those hosts turn an attempt into an alert rather than a post-incident discovery.

Patch the internet-reachable middleware first

Apply Oracle's July 2026 Critical Patch Update, but sequence it by exposure rather than by CVSS alone. The order that cuts the most real risk fastest:

1. Any WebLogic Server, Oracle HTTP Server or Coherence instance reachable from the internet or an untrusted network, patched first, since these carry the unauthenticated 10.0 and 9.8 code-execution flaws.

2. Access Manager, Unified Directory, WebCenter and the other Fusion Middleware that authenticate or broker access, next.

3. Everything else on your normal maintenance window, including MySQL, Java SE and VirtualBox, which carry no unauthenticated network code execution this cycle.

Where you cannot patch at once, take the affected service off the public internet: put WebLogic and its management ports behind a VPN or an allowlist so an unauthenticated attacker cannot reach the vulnerable surface at all. That does not fix the flaw, but it removes the exposure that turns it into an incident.