Over 1,000 New Vulnerabilities Disclosed in a Week as Critical Flaws Hit Oracle, OpenStack, and SAP

CyberDefender 12 mins0

On January 28, 2026, Cyble’s Vulnerability Intelligence team released its latest Week in Vulnerabilities report — and the findings paint a clear picture of how rapidly risk is escalating in enterprise IT environments. Over the past week, Cyble tracked 1,031 newly disclosed security vulnerabilities, and nearly 200 of those already have publicly available Proof-of-Concept (PoC) exploits, a combination that dramatically increases the odds these flaws will be weaponized in real attacks.

Big Numbers, Bigger Risks

What stands out most from the report isn’t just the sheer volume of newly disclosed vulnerabilities — it’s the severity and the availability of exploit code for many of them. Out of the 1,031 tracked:

  • 72 vulnerabilities were judged critical using the CVSS v3.1 scoring system, indicating they could lead to total system compromise or widespread damage if exploited.
  • 33 vulnerabilities also received a critical severity rating under the newer CVSS v4.0 system, signaling critical weaknesses from an updated risk perspective.
  • And nearly 200 of these vulnerabilities already have published proof-of-concept exploits floating around in public code repositories, underground forums, or scanning tools — meaning attackers don’t have to invent exploit logic from scratch.

The implications of those numbers are significant: vulnerabilities that already have PoCs are often exploited in the wild days to weeks after disclosure, especially if they are easy to attack or affect widely deployed software. Security teams that delay patching or mitigation face a much higher risk of being targeted.

High-Priority Vulnerabilities (and Why They Matter)

Below are the most critical, impactful vulnerabilities highlighted in the Cyble report — the ones defenders should move to address first:

1. CVE-2026-21969 – Oracle Agile Product Lifecycle Management (Supplier Portal)

  • Severity: Critical — CVSS Score 9.8.
  • Product: Oracle Agile Product Lifecycle Management for Process, specifically the Supplier Portal component within Oracle’s broader Supply Chain suite.
  • Impact: This flaw allows unauthenticated remote attackers to execute arbitrary code and take full control of the affected system simply by sending malformed HTTP requests. No login credentials, no user interaction, and no special privileges are required.

In practical terms, an attacker who can reach the Supplier Portal’s HTTP interface could use this vulnerability to completely compromise the Oracle PLM instance — leading to anything from data theft to total system manipulation. Because Oracle supplies software used by large enterprises and manufacturers globally, the potential blast radius of this flaw is broad.

Cybersecurity teams running Oracle Agile PLM should immediately verify if they are using affected versions and apply vendor patches or workarounds — delaying fixes here could leave environments exposed to real attacks.

2. CVE-2026-22797 – OpenStack Keystone Middleware Authentication Bypass & Privilege Escalation

  • Severity: Critical — CVSS Score 9.9.
  • Component: OpenStack keystonemiddleware’s external_oauth2_token authentication module.
  • Flaw Type: Authentication bypass leading to escalation of privileges or impersonation.

In many cloud environments, OpenStack Keystone acts as the identity and access management layer — effectively the “gatekeeper” for cloud resources. This vulnerability stems from a failure to properly sanitize incoming identity headers (such as X-Is-Admin-Project, X-Roles, or X-User-Id). An attacker with basic authenticated access can forge these headers, tricking the middleware into believing they have a different identity, including an admin’s.

That means an attacker could elevate their privileges to a higher-level role or impersonate another user entirely. In cloud or multi-tenant environments, this could lead to unauthorized access to tenant data, manipulation of resources, or even disruption of hosted services.

OpenStack administrators should review middleware configurations, update to patched versions, and implement additional identity validation controls to reduce risk.

3. CVE-2026-0501 – SAP S/4HANA SQL Injection (Financials General Ledger)

  • Severity: Critical — CVSS Score 9.9.
  • Module: SAP S/4HANA Private Cloud and On-Premise — Financials General Ledger component.
  • Flaw: SQL Injection that can be abused by an authenticated attacker.

This SQL injection vulnerability allows an attacker with low privileges to inject crafted queries into the back-end database. Depending on how the database is configured, this could allow:

  • Reading sensitive financial data.
  • Modifying records.
  • Deleting critical database content or disrupting services.

SQL injection remains one of the most dangerous and well-understood vectors — and when it affects ERP systems like SAP S/4HANA (which often store financials, accounting data, customer records, and other business-critical information), the results can be devastating.

SAP should provide patches, and affected organizations must schedule urgent updates, review database access logs for signs of injection attempts, and apply query filtering or parameterization strategies where possible.

Other Notable Vulnerabilities Mentioned

The report also highlights other significant vulnerabilities that merit attention, though they may not be at the absolute top of the list:

  • Salesforce Uni2TS Library (CVE-2026-22584, CVSS ~8.5): A code injection flaw affecting platforms on macOS, Windows, and Linux. It could allow attackers to execute arbitrary code embedded within files a system might not expect to execute.
  • Trend Micro Apex Central (CVE-2025-69258, CVSS 9.8): An unpatched remote code execution vulnerability that allows attackers to load malicious DLLs and gain SYSTEM-level execution if successfully exploited.
  • Vulnerabilities have also been added to the U.S. CISA’s Known Exploited Vulnerabilities (KEV) catalog, including issues affecting VMware vCenter Server (CVE-2024-37079), Microsoft Office Security Feature Bypass (CVE-2026-21509), and a Traefik reverse proxy improper authentication flaw (CVE-2025-34026). Inclusion in the KEV list signals active exploitation in the wild or strong evidence of imminent abuse.

Why This Matters: The Risk Landscape Today

The Cyble report underscores a few key cybersecurity realities:

  1. Volume alone isn’t the only concern. Yes, tracking over 1,000 vulnerabilities in a week is staggering — but what’s more important is that so many of them are critical and have published exploits.
  2. Attackers are weaponizing flaws fast. When PoCs become available, the average time to public exploitation shrinks. Organizations that assume “no one will attack us” because their systems aren’t high profile are putting themselves at risk.
  3. Enterprise and cloud platforms are increasingly targeted. Vendors like Oracle, SAP, OpenStack, Salesforce, and Trend Micro are foundational components in many enterprises; vulnerabilities in these platforms have wide consequences.
  4. Defenders need robust processes. Rapid disclosure demands automated patch management, staged testing, and meaningful risk prioritization — especially where critical systems are exposed externally.

What Security Teams Should Do Next

Here’s a prioritized action checklist based on the report:

Immediately:

  • Identify systems running the affected software (Oracle Agile PLM, OpenStack keystonemiddleware, SAP S/4HANA).
  • Apply vendor patches and test them in staging environments before rolling out broadly.
  • Use compensating controls (e.g., network filtering, WAF rules) where patches can’t be immediately deployed.

Within the next 72 hours:

  • Review logs and SIEM alerts for unusual activity related to these CVEs.
  • Conduct targeted scanning using authenticated vulnerability tools to confirm exposures.

Long-term:

  • Adopt risk-based vulnerability management that accounts for PoC availability and active exploitation trends.
  • Review identity and access controls, especially in cloud and hybrid environments.
  • Integrate automated alerting for CVE disclosures affecting key asset classes.

In summary: last week’s Cyble vulnerability report is a reminder that the threat landscape isn’t just growing — it’s accelerating. Organizations that treat vulnerability management as a backlog item, rather than a strategic risk priority, will find themselves reacting to attacks rather than preventing them. By focusing on the critical flaws highlighted here and adjusting patching and monitoring workflows accordingly, defenders can reduce their window of exposure — and avoid becoming tomorrow’s breach headline.

CyberDefender