Oracle's September 2026 Security Update Patches 800+ Critical Vulnerabilities

Oracle released 673 security patches in its September 2026 Critical Security Patch Update (CSPU), addressing over 800 vulnerabilities across its product suite.

Oracle’s September 2026 Critical Security Patch Update

The update includes 672 unique Common Vulnerabilities and Exposures (CVEs) cataloged in 17 risk matrices, with an additional 130 CVEs resolved through complementary fixes. At least 100 of the addressed flaws carry critical severity ratings, while more than 240 vulnerabilities can be exploited remotely without requiring authentication.

Product-Specific Patch Highlights

The Oracle E-Business Suite received the highest number of patches, with 159 updates, 19 of which mitigate unauthenticated remote exploitation risks. Fusion Middleware followed with 153 patches, including 78 fixes for remotely exploitable vulnerabilities. Hyperion was third, with 102 patches, 50 of which address unauthenticated remote access flaws.

Oracle Analytics: 50 patches
Oracle Communications: 31 patches
Oracle Commerce: 27 patches
Oracle Supply Chain: 19 patches
Virtualization: 19 patches
PeopleSoft: 16 patches

Notable Updates and Risks

The Oracle Communications update is notable for resolving over 125 additional CVEs beyond the primary 31 patches. Other products receiving critical updates include the Database Server, Enterprise Manager, Financial Services Applications, Application Testing Suite, Java SE, Autonomous Health Framework, and Utilities Applications.

“Customers who failed to apply available Oracle patches have been compromised,” the advisory stated.

Advisory and Recommendations

Oracle did not confirm active exploitation of these vulnerabilities but emphasized ongoing threat actor activity targeting unpatched systems. The company reiterated warnings that delayed patch deployment has led to successful attacks in past incidents. Oracle urged users to maintain supported software versions and prioritize immediate patch implementation.

Conclusion

The September 2026 CSPU underscores the importance of proactive patch management in mitigating risks associated with widely used enterprise software. Organizations are advised to review the CSPU advisory for detailed vulnerability disclosures and prioritize remediation efforts.