Oracle’s First 2026 CPU Delivers 337 New Security Patches

Oracle’s January 2026 CPU delivers 337 new security patches for over 30 products, with roughly 230 unique CVEs resolved in the update, according to Oracle’s January 2026 CPU advisory. The fixes include more than two dozen patches that address critical-severity vulnerabilities and over 235 patches addressing flaws that are remotely exploitable without authentication.

Roughly half a dozen patches address CVE-2025-66516, a critical defect in Apache Tika that could lead to XML External Entity injection, impacting three modules of Tika when XFA files are placed inside PDF documents. Oracle Communications received the largest number of fixes, at 56 (34 of which resolve bugs exploitable by remote, unauthenticated attackers), followed by Fusion Middleware with 51 patches, including 47 remotely exploitable.

The bulletin also notes additional patches across Financial Services Applications, MySQL, Siebel CRM, Retail Applications, and Virtualization, and mentions a separate Oracle Solaris Operating System bulletin describing 14 new patches, 11 of which can be exploited remotely without authentication.