Oracle Fixes Over 800 Vulnerabilities in September Security Update

Oracle has released its September 2026 Critical Security Patch Update (CSPU), containing 673 new security patches. The fixes address 672 unique CVEs across 17 risk matrices, while Oracle says patches for other flaws resolve more than 130 additional CVEs, bringing the total number of vulnerabilities addressed to more than 800. Over 100 of the newly fixed issues are rated critical, and more than 240 can reportedly be exploited remotely without authentication.

Oracle E-Business Suite received the largest set of updates, with 159 patches, including 19 for remotely exploitable, unauthenticated vulnerabilities. Fusion Middleware received 153 patches, including 78 affecting unauthenticated remote attack paths, while Hyperion received 102, including 50 of that type. Other heavily patched product groups include Siebel CRM (63), Analytics (50), Communications (31), Commerce (27), Supply Chain (19), Virtualization (19) and PeopleSoft (16). The Communications update also covers more than 125 additional CVEs.

Oracle has not said that any of the vulnerabilities are being exploited in the wild. However, it warned that attackers regularly target flaws in its products and said successful attacks have occurred when customers failed to install available patches. Oracle recommends that customers use actively supported product versions and apply the September updates without delay.