Oracle Issues September 2026 Security Update Addressing 673 Vulnerabilities

• •Oracle's September 2026 CSPU includes 673 security patches across 17 product families.
• •159 vulnerabilities in E-Business Suite and 153 in Fusion Middleware can be exploited remotely without authentication.
• •Oracle urges immediate patching due to ongoing exploitation of unpatched vulnerabilities.

On September 15, 2026, Oracle released a Critical Security Patch Update (CSPU) addressing 673 vulnerabilities across 17 product families, including Oracle E-Business Suite and Fusion Middleware. Among these, 159 patches were for E-Business Suite, and 153 for Fusion Middleware, with 19 and 78 vulnerabilities respectively that can be exploited remotely without authentication. The update includes critical vulnerabilities with CVSS scores of up to 10.0, affecting components such as Oracle Access Manager and Oracle WebLogic Server. Oracle has urged organizations to apply these patches immediately, citing ongoing reports of successful attacks on unpatched systems. The update also resolves over 800 vulnerabilities when including additional CVEs. Administrators are advised to consult Oracle's risk matrices for specific patch applicability. The vulnerabilities pose significant risks to confidentiality, integrity, and availability of affected systems.