Critical Bug Fix for CVE-2026-12505 in Oracle Linux 8 and 9

Linuxsecurity

Critical Bug Fix for CVE-2026-12505 in Oracle Linux 8 and 9

First seen 17 Jul 2026, 08:27 UTC • •70.5

Article Content

1 / 3

Browse articles

ThreatCluster •July 18, 2026 at 07:39 UTC

•CVE-2026-12505 allows local privilege escalation in Oracle Linux cifs-utils.
•Critical updates were released on 2026-07-17 for both Oracle Linux 8 and 9.
•Users are urged to apply patches immediately to prevent exploitation.

Oracle has released important bug fixes for CVE-2026-12505 affecting cifs-utils in both Oracle Linux 8 and 9. The vulnerability allows local privilege escalation (LPE) through cifs.spnego, impacting users of both distributions. The CVE was published on 2026-06-18, and the fixes were released on 2026-07-17. Users are advised to update their systems promptly to mitigate potential exploitation. The fixes address issues such as krb5 mount regression and compiler warnings. Both Oracle Linux 8 and 9 are affected, with specific updates provided for each version. The updates include version 7.0-5 for Oracle Linux 8 and version 7.6-2 for Oracle Linux 9, which resolve the identified vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 65d ago How this analysis works

Timeline

2026-06-18

CVE-2026-12505 published

Oracle disclosed a local privilege escalation vulnerability in cifs-utils affecting multiple Linux distributions.

2026-07-17

Patch released for Oracle Linux 8

Oracle released version 7.0-5 of cifs-utils to fix CVE-2026-12505, addressing multiple issues.

2026-07-17

Patch released for Oracle Linux 9

Oracle released version 7.6-2 of cifs-utils to resolve CVE-2026-12505, including fixes for krb5 mount regression.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Vulnerability (1)

CVE-2026-12505

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (2)

Linux
Oracle Linux

Relationships

CVE-2026-12505 targets Linux
CVE-2026-12505 targets Oracle Linux
CVE-2026-12505 related to CWE-269 - Improper Privilege Management

Following this threat?

Track CVE-2026-12505 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…