Vulnerabilities
Oracle Outside In PostScript RCE Vulnerability (CVE-2026-60412)
A heap‑based buffer overflow in Oracle Outside In Technology’s PostScript parser allows remote attackers to execute arbitrary code when a user opens a malicious file or visits a crafted page. Oracle has released a patch; administrators should update immediately and restrict access to PostScript content.
Oracle Outside In Technology is vulnerable to a heap‑based buffer overflow in its PostScript file parser. The flaw permits remote code execution when a user opens a malicious PostScript file or visits a page that triggers the parser. The vulnerability is identified as CVE‑2026‑60412 and carries a CVSS score of 7.8.
Impact
- Arbitrary code execution in the context of the Oracle Outside In process.
- Potential full system compromise if the service runs with elevated privileges.
- Requires user interaction (file open or page visit).
Mitigation
- Apply the Oracle patch released on 9 September 2026.
- Restrict or disable PostScript file handling on exposed web servers.
- Configure web application firewalls to block suspicious PostScript requests.
- Monitor logs for anomalous PostScript parsing activity.
Additional Information
Oracle’s security alert (CSPU Aug 2026) details the fix and recommends immediate update for all affected installations.
Related vulnerabilities
CVE-2026-108448: Outlook RCE Vulnerability - Update Confirmation
A remote code execution (RCE) vulnerability in Microsoft Outlook (CVE-2026-108448) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should verify October 2026 updates are applied; no further action is needed if already patched.
Read briefing
Oracle Outside In Technology PDF Parsing Integer Overflow Enables Remote Code Execution (CVE-2026-60392)
Oracle Outside In Technology is vulnerable to an integer overflow in PDF parsing that allows remote attackers to execute code when a user opens a crafted PDF or visits a malicious page. The flaw, CVE-2026-60392, carries a CVSS score of 7.8. Oracle has released a patch; administrators should update immediately and verify the fix.
Read briefing
Oracle VirtualBox VirtioSCSI Uninitialized Memory Disclosure – CVE‑2026‑71132
A flaw in VirtualBox’s VirtioSCSI driver lets a local attacker with high‑privileged guest code read hypervisor data. Oracle has released a patch; defenders should update immediately and review guest privilege levels.
Read briefing
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
Read briefing