Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle released its September 2026 Critical Security Patch Update (CSPU) addressing 672 unique CVEs with 673 patches across 17 product families. The update includes 104 critical severity patches and 503 high severity patches. Oracle E-Business Suite received the highest number of patches (159), followed by Oracle Fusion Middleware (153). Several vulnerabilities can be exploited remotely without authentication. Patches are available in the official advisory.
AI Analysis
Technical Summary
The September 2026 Oracle CSPU addresses 672 unique vulnerabilities with 673 security updates, including 104 critical severity issues. The update spans 17 Oracle product families, with Oracle E-Business Suite and Oracle Fusion Middleware receiving the most patches. Among these, multiple vulnerabilities allow remote exploitation without authentication. The update reflects Oracle's monthly CSPU cycle introduced in May 2026 to provide faster remediation of high-severity issues. Detailed patch information and affected products are provided in the official advisory.
Potential Impact
The vulnerabilities addressed include 104 critical and 503 high severity issues, some of which can be exploited remotely without authentication, potentially allowing attackers to compromise affected Oracle products. The large number of patches indicates widespread security risks across multiple Oracle product families, including critical enterprise applications such as Oracle E-Business Suite and Fusion Middleware.
Mitigation Recommendations
Patches for all addressed vulnerabilities are available in Oracle's September 2026 Critical Security Patch Update advisory. Organizations should promptly apply these official patches to mitigate the risks. No indication of 'no action required' or pre-mitigation status is provided; therefore, applying the official patches is the recommended remediation.
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Description
Oracle released its September 2026 Critical Security Patch Update (CSPU) addressing 672 unique CVEs with 673 patches across 17 product families. The update includes 104 critical severity patches and 503 high severity patches. Oracle E-Business Suite received the highest number of patches (159), followed by Oracle Fusion Middleware (153). Several vulnerabilities can be exploited remotely without authentication. Patches are available in the official advisory.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The September 2026 Oracle CSPU addresses 672 unique vulnerabilities with 673 security updates, including 104 critical severity issues. The update spans 17 Oracle product families, with Oracle E-Business Suite and Oracle Fusion Middleware receiving the most patches. Among these, multiple vulnerabilities allow remote exploitation without authentication. The update reflects Oracle's monthly CSPU cycle introduced in May 2026 to provide faster remediation of high-severity issues. Detailed patch information and affected products are provided in the official advisory.
Potential Impact
The vulnerabilities addressed include 104 critical and 503 high severity issues, some of which can be exploited remotely without authentication, potentially allowing attackers to compromise affected Oracle products. The large number of patches indicates widespread security risks across multiple Oracle product families, including critical enterprise applications such as Oracle E-Business Suite and Fusion Middleware.
Mitigation Recommendations
Patches for all addressed vulnerabilities are available in Oracle's September 2026 Critical Security Patch Update advisory. Organizations should promptly apply these official patches to mitigate the risks. No indication of 'no action required' or pre-mitigation status is provided; therefore, applying the official patches is the recommended remediation.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"stated","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.tenable.com/blog/oracle-september-2026-critical-security-patch-update-addresses-672-cves","fetched":true,"fetchedAt":"2026-09-15T21:15:42.517Z","wordCount":2261}
Threat ID: 6aa9b57e55bf5e2cf5619b2c
Added to database: 09/15/2026, 21:15:42 UTC
Last enriched: 09/15/2026, 21:15:46 UTC
Last updated: 09/16/2026, 03:18:42 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.