Oracle releases security fixes for supported on-premises (non-cloud) products as part its regular Critical Patch Updates (CPUs) cycle. The current release schedule for CPUs is on the third Tuesday of January, April, July, and October each year. Additional security fixes are occasionally released outside of the normal cycle, but these are known as “out-of-band” security alerts and bulletins.

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply all applicable security patches found within the Critical Patch Updates as soon as possible.

In this blog post, we will be summarising key details for the security patches contained within the latest product updates. The raw list can be viewed in full directly here: https://www.oracle.com/security-alerts/cpujan2025.html. You can also access a list of historical CPUs here: https://www.oracle.com/security-alerts/.

Commentary

The Oracle product ecosystem continues to pose a lucrative target for attackers, with the company reporting the confirmed exploitation this quarter of a critical access control bypass vulnerability in its Agile Product Lifecycle Management (PLM) Framework that led to the exfiltration of highly sensitive commercial data (CVE-2024-21287). Also exploited in the wild this quarter was a critical vulnerability in the company’s WebLogic Server (CVE-2020-2883), part of it Fusion Middleware platform.

The Oracle Critical Patch Updates for November 2024 through January 2025 also includes important updates for vulnerabilities in other products including Oracle Financial Services, Oracle Communications, PeopleSoft, JDEdwards EnterpriseOne Tools, MySQL Enterprise Backup, Oracle BI Publisher, Oracle SD-WAN Edge and Oracle Agile Engineering Data Management.

26 ‘Highly Exploitable’ Critical Vulnerabilities

The list of “Highly Exploitable” critical vulnerabilities below are those which have a ‘critical’ impact – rated as 9.0 or more out of 10 under the “CVSS” (Common Vulnerability) scoring system – but are also considered to be relatively trivial to exploit. They have (a) a network attack vector, (b) a low attack complexity, and (c) are remotely exploitable without authentication. This reflects those vulnerabilities that are believed to present the most critical risk to organisations, since they are both trivial to target, as well as having the potential to have significant impact (harm) if successfully exploited. “Highly exploitable” critical vulnerabilities are crucial to patch, and remediation is time sensitive – these type of vulnerabilities often feature in our “Known Exploited Vulnerabilities” (KEV) roundups as undergoing active exploitation if a threat group develops working exploit code and begins to actively target organisations. The vulnerabilities regarded as ‘highly exploitable’ criticals in Oracle products this month includes:

4 Additional Critical (CVSS 9+) Patches to Prioritise

Although Oracle considers all 318 vulnerabilities in their update to be critical, the list of “Critical” vulnerabilities below are those that Oracle have assigned a CVSS score of 9.0 or more, the threshold for ‘critical’ risk under the CVSS scoring system. Unlike the ‘highly exploitable’ vulnerabilities listed above, these vulnerabilities may be slightly more difficult for attackers to leverage. They may, for instance, not be remotely exploitable, or may require authentication in order to access. Potential exploit is still possible, especially as part of an exploit chain of multiple vulnerabilities. However, although the risk remains extremely high, it is slightly lower than that of the “highly exploitable” vulnerabilities listed above. Additional critical vulnerabilities highlighted by Oracle this month include:

Statistics

Total Oracle CVEs: 318
Highly Exploitable Critical Vulnerabilities: 26
Total Critical Vulnerabilities: 30

How to Protect Your Organisation with AppCheck

We recommend scanning your entire estate using the AppCheck vulnerability scanner regularly – both server systems and networking infrastructure, as well as end-user machines running desktop operating systems. Contact your account manager now if you are not already licensed for ‘internal scan hubs’ to cover scanning of your entire technical estate.

Next CPU Day

The next four dates for Critical Patch Updates will be on:

• 15th April 2025
• 15th July 2025
• 21st October 2025
• 21st January 2026

Add them to your calendar now!

Also keep an eye on our blog for coverage of other critical vulnerability updates including:

• Our weekly roundup of ‘Known exploited vulnerabilities’ from across all vendors, published weekly each Friday.
• End-of-Month Roundup of critical patch updates for all CISCO Products – next due on 31st January 2025
• Our monthly coverage of the ‘Patch Tuesday’ updates from MICROSOFT and several other major vendors – next due on 11th February 2025
• NEW – Monthly Security Advisory Roundups for PALO ALTO NETWORKS – next due on 13th February 2025
• NEW – Quarterly Roundups of Security Updates from IVANTI – next due on 3rd March 2025

About AppCheck

AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).