Oracle Critical Patch Update, July 2025 Security Update Review | Qualys

Summary: Oracle's July 2025 Critical Patch Update addresses 309 security vulnerabilities across its product families, with Oracle Communications receiving the most patches at 84, followed by Oracle MySQL at 40 and Oracle Fusion Middleware at 36. Of the total, 228 patches (about 74%) cover non-Oracle CVEs such as open-source components included in Oracle product distributions, and Oracle Fusion Middleware includes two critical vulnerabilities, CVE-2025-31651 and CVE-2024-52046, with a CVSS score of 9.8.
Why it matters: In Oracle Communications alone, 50 of the 84 patched vulnerabilities can be exploited over a network without user credentials, and the two Fusion Middleware flaws at CVSS 9.8 can be triggered remotely by an unprivileged attacker in a low-complexity attack.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-27349 CVE-2024-1135 CVE-2024-25638 CVE-2024-47606 CVE-2024-52046 CVE-2024-56406 CVE-2024-9287 CVE-2025-23016 CVE-2025-27363 CVE-2025-31651 CVE-2025-32415 CVE-2025-48734
Related: CVE-2025-27363: Free Type Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · May 06, 2025
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026