Oracle April 2026 Critical Patch Update Risk Matrices

www.oracle.com • April 21, 2026

This document provides the text form of the CPUApr2026 Advisory Risk Matrices. Please note that the CVE IDs in this document correspond to the same CVE IDs in the CPUApr2026 Advisory

This page contains the following text format Risk Matrices:

This table provides the text form of the Risk Matrix for Oracle Database Server.

This table provides the text form of the Risk Matrix for Oracle Adapter for Eclipse RDF4J.

This table provides the text form of the Risk Matrix for Oracle APEX.

This table provides the text form of the Risk Matrix for Oracle Autonomous Health Framework.

This table provides the text form of the Risk Matrix for Oracle Blockchain Platform.

This table provides the text form of the Risk Matrix for Oracle Essbase.

This table provides the text form of the Risk Matrix for Oracle Global Lifecycle Management.

This table provides the text form of the Risk Matrix for Oracle GoldenGate.

This table provides the text form of the Risk Matrix for Oracle Graph Server and Client.

This table provides the text form of the Risk Matrix for Oracle NoSQL Database.

This table provides the text form of the Risk Matrix for Oracle REST Data Services.

This table provides the text form of the Risk Matrix for Oracle TimesTen In-Memory Database.

This table provides the text form of the Risk Matrix for Oracle Commerce.

This table provides the text form of the Risk Matrix for Oracle Communications.

This table provides the text form of the Risk Matrix for Oracle Construction and Engineering.

This table provides the text form of the Risk Matrix for Oracle E-Business Suite.

This table provides the text form of the Risk Matrix for Oracle Enterprise Manager.

This table provides the text form of the Risk Matrix for Oracle Financial Services Applications.

This table provides the text form of the Risk Matrix for Oracle Fusion Middleware.

This table provides the text form of the Risk Matrix for Oracle Analytics.

This table provides the text form of the Risk Matrix for Oracle Life Science Applications.

This table provides the text form of the Risk Matrix for Oracle Hospitality Applications.

This table provides the text form of the Risk Matrix for Oracle Hyperion.

This table provides the text form of the Risk Matrix for Oracle Java SE.

This table provides the text form of the Risk Matrix for Oracle JD Edwards.

This table provides the text form of the Risk Matrix for Oracle MySQL.

This table provides the text form of the Risk Matrix for Oracle PeopleSoft.

This table provides the text form of the Risk Matrix for Oracle Retail Applications.

This table provides the text form of the Risk Matrix for Oracle Siebel CRM.

This table provides the text form of the Risk Matrix for Oracle Supply Chain.

This table provides the text form of the Risk Matrix for Oracle Systems.

This table provides the text form of the Risk Matrix for Oracle Utilities Applications.

This table provides the text form of the Risk Matrix for Oracle Virtualization.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle April 2026 Critical Patch Update Addresses 481 Vulnerabilities On April 21, 2026, Oracle released its Critical Patch Update (CPU) for April 2026, which includes 481 security patches addressing 241 unique CVEs across 28 product families. Among these, 34 patches are classified as critical. The Oracle Communications product family is notably affected, with 139 vulnerabilities, 93 of which are remotely exploitable without authentication. Other affected systems include Oracle E-Business Suite and Oracle Fusion Middleware, which also have multiple vulnerabilities that can be exploited remotely. Customers are urged to apply these patches immediately to mitigate risks. The update follows ongoing reports of exploitation attempts against previously patched vulnerabilities, emphasizing the importance of timely patch application. This advisory highlights the critical nature of maintaining updated systems to defend against potential attacks. 12 sources 72

Oracle April 2026 Critical Patch Update Risk Matrices

The full story

Extracted Entities

Platforms (33)