Oracle Database Server

Oracle Releases September 2026 Critical Security Patch Update Fixing 673 Issues Across Multiple Products

Oracle has published its monthly Critical Security Patch Update (CSPU) on September 15, 2026, delivering a total of 673 security fixes. The update addresses 672 unique CVEs after removing duplicates and targets a wide range of products including Oracle Database Server, Oracle Fusion Middleware, Oracle E-Business Suite, PeopleSoft, Siebel, and Oracle VM VirtualBox. Of the fixes, 607 received a CVSSv3 base score of 7.0 or higher, with 104 scoring 9.0 or above. Six vulnerabilities carry the maximum score of 10.0, while 15 are rated 9.9 and 44 are rated 9.8. Additionally, 247 of the issues can be exploited remotely without authentication. The CSPU serves as a smaller, more frequent complement to Oracle’s quarterly Critical Patch Update (CPU) releases.

Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities

Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.

Oracle Releases Quarterly Critical Patch Update Addressing 1449 Vulnerabilities Across Numerous Products

Oracle has issued its regular quarterly Critical Patch Update on July 21, 2026, delivering fixes for a total of 1449 vulnerabilities. After removing duplicates, the update covers 1235 unique CVEs and impacts a broad range of products including Oracle Database Server, Oracle Java SE, Oracle MySQL, Oracle Fusion Middleware, Oracle WebLogic Server, and many others. Among the fixes, 261 vulnerabilities received CVSS base scores of 9.0 or higher, with ten rated at the maximum score of 10.0. Additionally, 1024 issues scored 7.0 or above, and 663 vulnerabilities can be exploited remotely without authentication. The advisory provides detailed guidance for administrators to apply the patches promptly across enterprise environments.