Critical Patch Update

Oracle Releases September 2026 Critical Security Patch Update Fixing 673 Issues Across Multiple Products

Oracle has published its monthly Critical Security Patch Update (CSPU) on September 15, 2026, delivering a total of 673 security fixes. The update addresses 672 unique CVEs after removing duplicates and targets a wide range of products including Oracle Database Server, Oracle Fusion Middleware, Oracle E-Business Suite, PeopleSoft, Siebel, and Oracle VM VirtualBox. Of the fixes, 607 received a CVSSv3 base score of 7.0 or higher, with 104 scoring 9.0 or above. Six vulnerabilities carry the maximum score of 10.0, while 15 are rated 9.9 and 44 are rated 9.8. Additionally, 247 of the issues can be exploited remotely without authentication. The CSPU serves as a smaller, more frequent complement to Oracle’s quarterly Critical Patch Update (CPU) releases.

Oracle Releases Quarterly Critical Patch Update Addressing 1449 Vulnerabilities Across Numerous Products

Oracle has issued its regular quarterly Critical Patch Update on July 21, 2026, delivering fixes for a total of 1449 vulnerabilities. After removing duplicates, the update covers 1235 unique CVEs and impacts a broad range of products including Oracle Database Server, Oracle Java SE, Oracle MySQL, Oracle Fusion Middleware, Oracle WebLogic Server, and many others. Among the fixes, 261 vulnerabilities received CVSS base scores of 9.0 or higher, with ten rated at the maximum score of 10.0. Additionally, 1024 issues scored 7.0 or above, and 663 vulnerabilities can be exploited remotely without authentication. The advisory provides detailed guidance for administrators to apply the patches promptly across enterprise environments.