Back Securityweek

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Securityweek • September 16, 2026

Oracle on Tuesday announced the release of 673 new security patches as part of its September 2026 Critical Security Patch Update (CSPU).

The security updates appear to resolve more than 800 vulnerabilities: there are 672 unique CVEs in the 17 risk matrices included in the September 2026 CSPU advisory , but Oracle also notes that more than 130 additional CVEs have been resolved with the patches for other flaws.

More than 100 of the newly addressed security defects are critical-severity flaws, and over 240 are remotely exploitable without authentication.

Oracle E-Business Suite received 159 security patches, the largest batch of the CSPU. 19 of the vulnerabilities can be exploited remotely without authentication.

Fusion Middleware followed closely, receiving 153 patches, including fixes for 78 unauthenticated, remotely exploitable flaws. Hyperion was third, with 102 patches (50 remotely exploitable without authentication).

Oracle also rolled out a significant number of patches for Siebel CRM (63), Analytics (50), Communications (31), Commerce (27), Supply Chain (19), Virtualization (19), and PeopleSoft (16).

The Communications update stands out, as half of its patches resolve more than 125 additional CVEs.

Other Oracle products that received patches this month include Database Server, Enterprise Manager, Financial Services Applications, Application Testing Suite, Java SE, Autonomous Health Framework, and Utilities Applications.

Oracle makes no mention of any of these vulnerabilities being exploited in the wild, but warns users that threat actors are regularly exploiting flaws in its products, urging customers to apply the updates as soon as possible.

“In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay,” Oracle notes.

Related: $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Related: Thai Broadband Provider Hacked via Fortinet Vulnerability

Related: Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Issues September 2026 Security Update Addressing 673 Vulnerabilities On September 15, 2026, Oracle released a Critical Security Patch Update (CSPU) addressing 673 vulnerabilities across 17 product families, including Oracle E-Business Suite and Fusion Middleware. Among these, 159 patches were for E-Business Suite, and 153 for Fusion Middleware, with 19 and 78 vulnerabilities respectively that can be exploited remotely without authentication. The update includes critical vulnerabilities with CVSS scores of up to 10.0, affecting components such as Oracle Access Manager and Oracle WebLogic Server. Oracle has urged organizations to apply these patches immediately, citing ongoing reports of successful attacks on unpatched systems. The update also resolves over 800 vulnerabilities when including additional CVEs. Administrators are advised to consult Oracle's risk matrices for specific patch applicability. The vulnerabilities pose significant risks to confidentiality, integrity, and availability of affected systems. 9 sources 74

Extracted Entities

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

The full story

Extracted Entities

Attack Types (2)

Industries (1)

Platforms (16)