Oracle's September 2026 Critical Security Patch Update (CSPU) includes 673 new security patches resolving over 800 vulnerabilities, with more than 100 classified as critical severity. Among these, over 240 vulnerabilities are remotely exploitable without authentication. The patches cover 17 Oracle product families, with the largest number applied to Oracle E-Business Suite (159 patches), Fusion Middleware (153 patches), and Hyperion (102 patches). Other products patched include Siebel CRM, Analytics, Communications, Commerce, Supply Chain, Virtualization, PeopleSoft, Database Server, Enterprise Manager, Financial Services Applications, Application Testing Suite, Java SE, Autonomous Health Framework, and Utilities Applications. Oracle emphasizes the importance of applying these patches promptly to mitigate risks, noting that some attackers have succeeded due to unpatched systems. There is no current evidence of exploitation in the wild for these specific vulnerabilities.

The vulnerabilities addressed include over 100 critical-severity flaws, many of which are remotely exploitable without authentication, potentially allowing attackers to compromise affected systems. The broad range of affected Oracle products means that multiple enterprise environments could be at risk if patches are not applied. However, no active exploitation of these vulnerabilities has been reported so far. Failure to apply these patches could expose organizations to increased risk of compromise.

Oracle strongly recommends that customers remain on actively supported versions and apply the September 2026 Critical Security Patch Update without delay. Applying these patches promptly is the primary mitigation to address the vulnerabilities. No additional mitigation guidance or temporary workarounds are provided or indicated by Oracle at this time.