# Oracle Patches Over 150 Fusion Middleware Flaws

Published: 2026-10-22 · Severity: high · Sectors: Technology, Financial Services, Government (National), Manufacturing, Telecommunications
Canonical: https://vorant.io/reports/31e7ed0c-3007-5c6f-880d-7b929b23b5d6/oracle-patches-over-150-fusion-middleware-flaws

> Oracle's latest Critical Patch Update fixes over 150 vulnerabilities across WebLogic, SOA Suite, Identity Manager, Access Manager and related Fusion Middleware products, several rated CVSS 9.8-10.0.

NCSC-NL has issued a high-priority advisory summarizing Oracle's Critical Patch Update covering Oracle Fusion Middleware and related products, including Oracle SOA Suite, WebLogic Server, Data Integrator, Identity Manager, Access Manager, WebCenter Content, Fusion Middleware (including Helidon), and Oracle HTTP Server. The update addresses a very large number of vulnerabilities spanning insecure deserialization, missing or broken authentication and authorization, flaws in network protocols (HTTP, HTTP/2, SOAP, T3, IIOP, LDAP), and issues in third-party cryptographic/parsing libraries such as Bouncy Castle and Jackson-databind.

Multiple flaws carry CVSS scores up to 10.0 and allow unauthenticated network-based exploitation leading to arbitrary code execution, full system compromise, unauthorized data access or manipulation, denial of service via resource exhaustion, privilege escalation, and cross-site scripting/spoofing. NCSC-NL notes that no public proof-of-concept exploit code is currently known, but given the widespread deployment of these Oracle products and the nature of the flaws (several network-reachable, pre-auth, and deserialization-based), it expects a short-term increase in scanning and exploitation attempts.

Defenders running any of the affected Oracle Fusion Middleware components should prioritize applying Oracle's October Critical Patch Update immediately, focusing first on internet-facing WebLogic, Access Manager, and HTTP Server instances, and monitor for anomalous T3/IIOP/LDAP traffic, unexpected deserialization activity, and unauthorized administrative access as indicators of attempted exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2022-1471 (weaponized), CVE-2026-101499, CVE-2026-101590, CVE-2026-41635, CVE-2026-4176, CVE-2026-42779, CVE-2026-47065, CVE-2026-5598, CVE-2026-83396, CVE-2026-83397, CVE-2026-83399, CVE-2026-87251, CVE-2026-87302, CVE-2026-87337, CVE-2026-87347, CVE-2026-8763, CVE-2026-91214, CVE-2026-91216, CVE-2026-91218, CVE-2026-91220, CVE-2026-91221, CVE-2026-91222, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91233, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91243, CVE-2026-91250, CVE-2026-91251, CVE-2026-91323, CVE-2026-91354, CVE-2026-91408, CVE-2026-91490, CVE-2026-91491, CVE-2026-91495

## Detection guidance (public sample)

### WebLogic Java Process Spawning Shell or LOLBin on Windows

ATT&CK: T1190

Detects a WebLogic server JVM spawning cmd, PowerShell or common download/execute binaries, a typical post-exploitation pattern after pre-auth deserialization RCE (T3/IIOP/HTTP). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebLogic Java Process Spawning Shell or LOLBin on Windows
description: Detects a java.exe process running WebLogic spawning command interpreters
  or download/execute utilities. This is the typical post-exploitation pattern after
  unauthenticated deserialization RCE via T3, IIOP or HTTP against Oracle Fusion Middleware.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - weblogic.Server
    - weblogic.Name
    - \wlserver
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection_parent and selection_child
falsepositives:
- WebLogic administrators running custom maintenance scripts through the server JVM
- Application deployments that shell out to cmd.exe from WebLogic-hosted applications
level: high
id: 126b6bab-8306-51d0-b04f-2f9e855ffaae
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0448.html
```

### Java Process Spawning Shell with Download or Reverse Shell Pattern on Linux

ATT&CK: T1190

Detects a Java process (e.g. WebLogic, Helidon) spawning a shell that downloads payloads or opens a reverse shell, indicating exploitation of a deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell with Download or Reverse Shell Pattern on Linux
description: Detects a Java application server process such as WebLogic or Helidon
  spawning sh or bash with command lines that download payloads, decode base64 or
  open reverse shells. This pattern is expected after exploitation of pre-auth deserialization
  flaws in Oracle Fusion Middleware.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /bash
    - /sh
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl http
    - wget http
    - /dev/tcp/
    - base64 -d
    - base64 --decode
    - nc -e
    - chmod +x /tmp
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based build or deployment tooling that downloads artifacts with curl or wget
  from a shell
- Application health-check scripts launched by the JVM
level: high
id: 72a5eede-8e2e-5eab-b59d-b489d9c1acfd
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0448.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0448.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/31e7ed0c-3007-5c6f-880d-7b929b23b5d6/oracle-patches-over-150-fusion-middleware-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup