Oracle Releases 943 Security Patches in August 2026 Critical Security Update

Extensive Security Update Released

Oracle announced the release of 943 new security patches as part of its August 2026 Critical Security Patch Update (CSPU). This marks the company's third monthly security rollout, addressing a broad range of vulnerabilities across its product portfolio.

Scope of Vulnerabilities

The update covers more than 1,000 unique CVEs across two dozen Oracle products. A significant portion, over 460 vulnerabilities, can be exploited remotely without requiring authentication. Additionally, more than 150 of the identified security defects are critical-severity bugs, with nearly 90 of these having a CVSS score of 9.8 or higher.

Affected Products

Fusion Middleware and Hyperion received the largest number of new security patches, each with 262, including over 100 critical-severity flaws. Other products receiving substantial updates include E-Business Suite (120), Commerce (66), Siebel CRM (50), and Supply Chain (46). Fixes were also provided for VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, and Java SE, among others.

Context and Impact

While substantial, the August 2026 CSPU's 1,000 resolved security defects are slightly fewer than the 1,449 patches released in the July 2026 Critical Patch Update. Oracle attributes the high volume of patches to its use of advanced LLM models for vulnerability discovery. Oracle advises customers to apply these security updates promptly due to known exploitation attempts of vulnerabilities in Oracle products.