IT managers need to roll up their sleeves: Oracle has released a total of 337 new security patches for the “Critical Patch Update” (CPU) called patch day in January 2026. They close security vulnerabilities in 122 products from the company's portfolio.
In the security advisory for the January CPU, Oracle lists the 122 affected products and versions. IT managers should act quickly with the provided updates, especially concerning security vulnerabilities that developers classify as critical risks. Vulnerabilities of such severity are found in:
Many products also have high-risk vulnerabilities that narrowly miss being classified as critical risks. Among them are some popular products like Oracle VM VirtualBox, which alone has eleven high-risk vulnerabilities. IT admins should therefore review Oracle's overview to see if they are using any vulnerable products and schedule the patches promptly.
Previously, an Oracle patch day took place in October 2025. There, the company even addressed security leaks in its software with 374 software fixes. The “Admin Action Day” with Oracle updates is planned for April 21, 2026.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
