Oracle Critical Patch Update, April 2025 Security Update Review | Qualys

Summary: Oracle's April 2025 Critical Patch Update addressed 378 security vulnerabilities across its product families, with Oracle Communications receiving the most at 103 patches, followed by Oracle MySQL with 43 and Oracle Communications Applications with 42. Of the 378 patches, 300 (about 79%) are for non-Oracle CVEs such as open-source components included in Oracle product distributions.
What you should know: In Oracle Communications alone, 82 of the 103 patched vulnerabilities can be exploited over a network without user credentials, and critical-rated CVEs like CVE-2024-40896 in MySQL Workbench carry a CVSS score of 9.1 - a remote attacker needs no privileges and a low-complexity attack to reach them.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-11053 CVE-2024-38476 CVE-2024-40896 CVE-2024-47561 CVE-2024-52046 CVE-2024-5535 CVE-2024-56337 CVE-2025-1974 CVE-2025-24813
Related: CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability Known Exploited Vulnerabilities · Apr 01, 2025
Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack Cyber Risks ·
Oracle Critical Patch Update, July 2025 Security Update Review | Qualys Cyber Risks ·