Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Source Tenable Research
Rated Critical by Tenable Research
Data as of 15 Sep 2026, 21:15 UTC
What to do
AI-suggested
Patches for all addressed vulnerabilities are available in Oracle's September 2026 Critical Security Patch Update advisory. Organizations should promptly apply these official patches to mitigate the risks. No indication of 'no action required' or pre-mitigation status is provided; therefore, applying the official patches is the recommended remediation.
Description
Oracle released its September 2026 Critical Security Patch Update (CSPU) addressing 672 unique CVEs with 673 patches across 17 product families. The update includes 104 critical severity patches and 503 high severity patches. Oracle E-Business Suite received the highest number of patches (159), followed by Oracle Fusion Middleware (153). Several vulnerabilities can be exploited remotely without authentication. Patches are available in the official advisory.