{“lastseen”:”2026-04-22T16:05:08″,”description”:”Oracle released its second quarterly edition of this year\u2019s Critical Patch Update. The update received patches for **481** security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.\\n\\nIn this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 139, constituting about 28% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 75 and 59 security patches.\\n\\n376 of the 481 security patches provided by the April Critical Patch Update (about 78%) are for non-Oracle CVEs, such as open-source components included in and exploitable within Oracle product distributions.\\n\\nThis batch of security patches received 27 updates for Oracle Database products. The following is the product-wise distribution:\\n\\n * Eight new security updates for Oracle Database Server with a maximum reported CVSS Base Score of 7.5. \\n * One of these updates applies to client-only deployments of the Oracle Database. \\n * Two new security updates for the Oracle Autonomous Health Framework with a maximum reported CVSS Base Score of 7.2.\\n * Three new security updates for Oracle Blockchain Platform with a maximum reported CVSS Base Score of 7.5.\\n * 10 new security updates for Oracle GoldenGate with a maximum reported CVSS Base Score of 7.5.\\n * Two new security updates for Oracle REST Data Services with a maximum reported CVSS Base Score of 7.5.\\n * One new security update for Oracle TimesTen In-Memory Database with a maximum reported CVSS Base Score of 7.4.\\n\\n\\n\\nIn these security updates, Oracle has covered product families, including Oracle Database Server, Oracle Adapter for Eclipse RDF4J, Oracle Autonomous Health Framework, Oracle Blockchain Platform, Oracle GoldenGate, Oracle REST Data Services, Oracle TimesTen In-Memory Database, Oracle Commerce, Oracle Communications, Oracle Construction and Engineering, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Fusion Middleware, Oracle Analytics, Oracle Life Science Applications, Oracle Hospitality Applications, Oracle Hyperion, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Siebel CRM, Oracle Supply Chain, Oracle Systems, Oracle Utilities Applications, and Oracle Virtualization.\\n\\n## Qualys QID Coverage\\n\\nQualys has released the following QIDS mentioned in the table:\\n\\n**QIDs**| **Title** \\n—|— \\n20574| Oracle E-Business Suite Security Update (CPUAPR2026) \\n20573| Oracle MySQL Server April 2026 Critical Patch Update (CPUAPR2026) \\n20572| Oracle Database 19c Critical Patch Update – April 2026 \\n20571| Oracle Database 19c OJVM Critical Patch Update – April 2026 \\n20570| Oracle Database 21c Critical Patch Update – April 2026 \\n387130| Oracle MySQL Connectors April 2026 Critical Patch Update (CPUAPR2026) \\n387129| Oracle Hypertext Transfer Protocol (HTTP) Server April 2026 Critical Patch Update (CPUAPR2026) \\n387128| Oracle Managed Virtualization (VM) VirtualBox April 2026 Critical Patch Update (CPUAPR2026) \\n387117| Oracle Java Standard Edition (SE) Critical Patch Update – April 2026 (CPUAPR2026) \\n87606| Oracle WebLogic Server Multiple Vulnerabilities (CPUAPR2026) \\n296136| Oracle Solaris 11.4 Support Repository Update (SRU) 92.214.1 Missing (CPU2026APR) \\n \\n**Note:** The table will be updated with additional QIDs once released.\\n\\n## Notable Oracle Vulnerabilities Patched\\n\\n### Oracle Communications\\n\\nThis Critical Patch Update for Oracle Communications received 139 security patches. Out of these, 93 vulnerabilities can be exploited over a network without user credentials.\\n\\nCVE-2025-6965, CVE-2025-68615, CVE-2026-25968, CVE-2025-48913, CVE-2025-12543, CVE-2024-5535, CVE-2025-55130, and CVE-2025-58050 have critical severity and CVSS scores of 9.8, 9.6, and 9.1. Successful exploitation of these vulnerabilities can lead to remote code execution.\\n\\n### Oracle Financial Services Applications\\n\\nThis Critical Patch Update for Oracle Financial Services Applications received 75 security patches. Out of these, 59 vulnerabilities can be exploited over a network without user credentials.\\n\\nCVE-2023-34034 and CVE-2023-44981 have critical severity and CVSS scores of 9.8, and 9.1, respectively. Successful exploitation of these vulnerabilities can lead to remote code execution.\\n\\n### Oracle Fusion Middleware\\n\\nThis Critical Patch Update for Oracle Fusion Middleware received 59 security patches. Out of these, 46 vulnerabilities can be exploited over a network without user credentials.\\n\\nCVE-2022-45047, CVE-2025-68615, CVE-2026-34285, CVE-2026-34286, CVE-2026-34287, and CVE-2021-45046 have critical severity and CVSS scores of 9.8, 9.1, and 9.0, respectively. Successful exploitation of these vulnerabilities can lead to remote code execution.\\n\\n### Oracle MySQL\\n\\nThis Critical Patch Update for Oracle MySQL received 34 security patches. Out of these, three vulnerabilities can be exploited over a network without user credentials.\\n\\nCVE-2025-15467 in the Enterprise Backup component of MySQL Enterprise Backup has critical severity and a CVSS score of 9.8. Successful exploitation of this vulnerability can result in remote code execution.\\n\\n### Oracle E-Business Suite receives\\n\\nThis Critical Patch Update for Oracle E-Business Suite received 18 security patches. Out of these, eight vulnerabilities can be exploited over a network without user credentials.\\n\\nCVE-2026-34275 in the Setup and Administration component of Oracle Advanced Inbound Telephony has critical severity with CVSS scores of 9.8. Successful exploitation of this vulnerability can result in remote code execution.”,”published”:”2026-04-22T14:34:25″,”modified”:”2026-04-22T14:34:25″,”type”:”qualysblog”,”title”:”Oracle Critical Patch Update,\u00a0April 2026\u00a0Security Update Review”,”source”:””,”references”:””,”id”:”QUALYSBLOG:B68DC86B8D12D15500EC1942C65069F5″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[“CVE-2021-45046″,”CVE-2022-45047″,”CVE-2023-34034″,”CVE-2023-44981″,”CVE-2024-5535″,”CVE-2025-12543″,”CVE-2025-15467″,”CVE-2025-48913″,”CVE-2025-55130″,”CVE-2025-58050″,”CVE-2025-68615″,”CVE-2025-6965″,”CVE-2026-25968″,”CVE-2026-34275″,”CVE-2026-34285″,”CVE-2026-34286″,”CVE-2026-34287″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:N”,”baseScore”:7.1,”baseSeverity”:”HIGH”,”attackVector”:”LOCAL”,”attackComplexity”:”LOW”,”privilegesRequired”:”LOW”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”NONE”}},”href”:”https:\/\/blog.qualys.com\/category\/vulnerabilities-threat-research”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-22T16:05:08″,”description”:”Oracle released its second quarterly edition of this year\u2019s Critical Patch Update. The update received patches for **481** security vulnerabilities. Some of the vulnerabilities addressed…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[9,6,8,35,12,13,120,7,11,5],"class_list":["post-48733","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-qualysblog","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n