Oracle CSPU May 2026: 35 Critical Vulnerabilities Addressed

Oracle released its first Critical Security Patch Update (CSPU) on May 28, 2026, addressing 35 vulnerabilities across multiple product families, including Oracle Database, Oracle REST Data Services, and Oracle E-Business Suite. Among these, CVE-2026-46840 and CVE-2026-34311 are rated critical, with CVSS scores of 10.0 and 9.8, respectively. Attackers can exploit several vulnerabilities remotely without authentication, posing significant risks to organizations using affected Oracle products. The CSPU is part of Oracle's new monthly update strategy, aimed at providing timely security fixes. Security professionals are urged to apply the patches immediately to mitigate risks associated with these vulnerabilities. The update follows a history of exploitation of Oracle vulnerabilities, emphasizing the need for prompt action.

Key Points: • Oracle's CSPU addresses 35 vulnerabilities, including 11 critical ones. • CVE-2026-46840 has a CVSS score of 10.0, indicating severe risk. • Immediate patching is recommended to prevent potential exploitation.