Oracle shipped one of its biggest security updates of 2026 on September 15, closing out 673 patches that resolve more than 800 vulnerabilities across 17 product families. The release, formally called the September 2026 Critical Security Patch Update (CSPU), landed the same week Microsoft pushed its own record-setting Patch Tuesday, turning mid-September into one of the heaviest patching stretches IT teams have faced all year. At least one flaw is already being exploited in the wild, according to a Hong Kong government cybersecurity advisory, and researchers have flagged public proof-of-concept code for seven more.
This release adds to a busy month of enterprise cybersecurity threats in 2026. For enterprises running Oracle Database, E-Business Suite, Fusion Middleware, or Java SE, this is not a routine monthly chore. It is a stress test of how fast large organizations can triage, prioritize, and deploy patches across systems that often sit deep inside finance, HR, and supply chain operations. Here is what the September 2026 Oracle Critical Security Patch Update actually contains, why the numbers keep climbing, and what security teams should do about it this week.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside the September 2026 Critical Security Patch Update
Oracle’s advisory, published September 15, 2026, lists 672 unique CVEs spread across 17 risk matrices. SecurityWeek reported that the actual patch count is 673 new security patches, and that the effective total climbs past 800 vulnerabilities once more than 130 additional CVEs bundled into other fixes are counted. CybersecurityNews reached the same figures independently, describing the release as “one of its largest monthly security bundles to date.”
Tenable’s own breakdown, published the same day the advisory went live, confirms the core numbers: 672 CVEs, 673 patches, and 104 flaws rated critical severity — a figure Qualys independently corroborated in its own September 2026 analysis. That critical count alone is roughly 10 times higher than what Oracle patched in its June 2026 monthly release, and it puts September 2026 on pace to be the largest Oracle CSPU of the year. The affected product list, straight from Oracle’s own advisory page, spans Oracle Database Server, Autonomous Health Framework, Application Testing Suite, Commerce, Communications, E-Business Suite, Enterprise Manager, Financial Services Applications, Fusion Middleware, Analytics, Hyperion, Java SE, PeopleSoft, Siebel CRM, Supply Chain, Utilities Applications, and Virtualization. Oracle Database itself picked up just 11 patches in this round, with a maximum CVSS score of 8.8 according to Qualys, and Oracle’s own advisory lists Oracle Database 23.26.3.0.0 as the version covered by the September 2026 release.
104 Critical Flaws: Breaking Down the Severity
A “critical” rating in Oracle’s world maps to a CVSS 3.1 base score of 9.0 or higher, the band reserved for bugs that typically allow full system compromise with little or no user interaction. Tenable’s analysis puts that count at 104 for this single release, while SecurityWeek independently described “more than 100” critical-severity defects in its coverage. This batch does include maximum-severity outliers: CIO reported that Fusion Middleware alone carries five CVSS 10.0 flaws, and Fortra’s analysis flagged a maximum-score CVSS 10.0 bug inside the Hyperion patch set as well, putting September’s release in the same company as the standalone CVSS 10.0 bugs already seen in 2026 on other enterprise platforms, including a GitLab flaw and a SAP OVERPASS bug. That combination of multiple perfect-score flaws and more than 100 critical-rated bugs is what has pushed vulnerability management teams into overtime this week.
CVE-2026-64849 Is Already Being Exploited
The Hong Kong government’s cybersecurity response team, GovCERT, issued its own alert on the September batch, and it contains the most urgent line in any of the public write-ups so far: reports indicate that a remote code execution vulnerability tracked as CVE-2026-64849 is being exploited in the wild. That single data point changes the calculus for any organization weighing whether to patch immediately or wait for a scheduled maintenance window. Active exploitation means attackers are not waiting, and neither can defenders.
Seven More CVEs Have Public Exploit Code
Beyond the one confirmed active exploit, GovCERT’s advisory names seven additional CVEs with publicly available proof-of-concept exploit code: CVE-2026-2332, CVE-2026-7598, CVE-2026-9563, CVE-2026-57220, CVE-2026-59943, CVE-2026-63308, and CVE-2026-75838. Public PoC code does not guarantee active attacks, but it dramatically lowers the skill floor for anyone who wants to weaponize a flaw. Security researchers generally treat a CVE with public PoC code the same way they treat one with confirmed exploitation for prioritization purposes, because the window between “PoC published” and “used in real attacks” has been shrinking for years.
Which Oracle Products Got Hit Hardest
Not every one of the 17 product families carries equal risk. Tenable’s patch-count table shows a heavy concentration in a handful of enterprise applications that sit closest to the internet or to sensitive business data, and CIO’s own September 2026 tally lines up with those figures: E-Business Suite alone accounts for 159 patches, the largest product-family total in the release, and Fusion Middleware carries 153, together making up nearly half of all documented fixes in the release.
| Oracle Product Family | Patches in September 2026 CSPU | Remotely Exploitable Without Authentication |
|---|---|---|
| Oracle E-Business Suite | 159 | 19 |
| Oracle Fusion Middleware | 153 | 78 |
| Oracle Hyperion | 102 | 50 |
| Oracle Siebel CRM | 63 | 26 |
| Oracle Analytics | 50 | 8 |
| Oracle Communications | 31 | 23 |
| Oracle Java SE | 3 | 3 |
The Java SE line is the one that should catch a security team’s eye despite its small patch count. All three Java SE fixes in this release are remotely exploitable without any login credentials, according to Tenable’s per-family breakdown, meaning every single flaw in that product line carries the worst possible exposure profile. Fusion Middleware’s 78 unauthenticated remote flaws out of 153 total patches is the more alarming raw number, since middleware often runs internet-facing application servers that connect directly to backend databases.
The Remote-Exploit Problem: 240-Plus Flaws Need No Login
SecurityWeek and CybersecurityNews independently arrived at the same headline risk figure, and Fortra’s own analysis pinned down the exact number: 246 of the 672 documented CVEs in this release are remotely exploitable without authentication. That means an attacker sitting anywhere on the internet, with no valid username or password, could potentially trigger these flaws over the network. For context, that is more than a third of the entire CVE count in a single Oracle release, a far higher ratio than security teams typically see even in large Patch Tuesday batches from other vendors.
This is the detail driving most of the urgency in vendor commentary this week. Qualys’ ThreatPROTECT feed flagged the release the same day it dropped, noting that “Oracle released its September edition of Critical Security Patch Update” with patches for 673 security vulnerabilities and that some of them touch more than one product simultaneously, according to Qualys’ live threat intelligence feed. When a single flaw spans multiple product lines, a patch delay in one system can leave an organization exposed through a completely different application.
From Quarterly to Monthly: Why Oracle Overhauled Its Cadence in 2026
For roughly two decades, Oracle ran its Critical Patch Update program on a quarterly schedule, typically releasing fixes in January, April, July, and October. That cadence gave enterprise IT teams a predictable but infrequent rhythm to plan around, and it also meant vulnerabilities sometimes sat unpatched in production for months after discovery. In 2026, Oracle broke from that model entirely.
CIO.com reported in June 2026 that Oracle’s first monthly Critical Security Patch Update, released June 16, fixed just 35 flaws, 11 of them rated critical. The same report laid out the new schedule going forward: CSPUs would ship on the third Tuesday of every month, with June 16, July 21, August 18, and September 15 named as the first four dates. That shift from four releases a year to twelve is exactly why the volume comparisons across 2026 look so dramatic, and it is also why security teams now need a monthly Oracle patch process rather than a quarterly one.
The 2026 Patch Volume Trend: June Through September
The jump from Oracle’s first monthly release to its fourth is stark. Publicly reported figures for three of the four 2026 CSPUs show a clear escalation in both total volume and critical-severity counts as the year has progressed.
| 2026 Oracle CSPU | Release Date | Total CVEs / Patches | Critical-Severity Flaws |
|---|---|---|---|
| June 2026 (first monthly CSPU) | June 16, 2026 | 35 flaws | 11 |
| July 2026 | July 21, 2026 | Not separately detailed in available coverage | Not separately detailed |
| August 2026 | August 18, 2026 | 531 CVEs | 10 |
| September 2026 | September 15, 2026 | 672 CVEs / 673 patches | 104 |
The July figures were not broken out with the same level of detail in the sources reviewed for this report, so this article treats that row as unconfirmed rather than guessing at a number. What is confirmed is the shape of the trend: August’s CVE count already ballooned to 531, and September pushed both the total CVE count and the critical-severity count higher still, with critical flaws jumping more than tenfold compared to August. If that trajectory holds, Oracle’s October CSPU will be worth watching closely.
Oracle vs Microsoft: How September’s Two Mega-Patches Compare
Oracle’s release did not land in isolation. The same week, Microsoft shipped what multiple outlets called a record-breaking Patch Tuesday, fixing 966 flaws including two exploited zero-days, according to coverage aggregated by Integrity360’s weekly cyber news roundup. Stack the two releases side by side and IT teams faced roughly 1,600 combined vulnerability disclosures from just two vendors inside a single seven-day window.
Same Week, Different Risk Profile
The two releases differ in a meaningful way. Microsoft’s Patch Tuesday touches operating systems and consumer-facing software that most organizations patch through automated pipelines within days. Oracle’s CSPU disproportionately hits enterprise applications like E-Business Suite, Fusion Middleware, and Hyperion, systems that often require change-control approval, extended testing windows, and sometimes vendor-specific downtime scheduling before a patch can go live. That difference in patching friction is exactly why Oracle vulnerabilities tend to stay unpatched in production far longer than operating-system flaws, even when the CVSS scores are comparable.
Why Enterprise Middleware Is the Real Risk Center
Fusion Middleware’s 78 unauthenticated remote-exploit flaws are the single most consequential number in this release for large enterprises. Middleware sits at the connective layer between web-facing applications and backend databases, which means a successful exploit there can become a pivot point into far more sensitive systems. E-Business Suite carries a smaller share of unauthenticated remote flaws relative to its patch count, but it remains a favorite target for attackers precisely because it houses financial, HR, and supply chain data that is directly monetizable once stolen.
This pattern is not new for Oracle’s stack specifically. E-Business Suite has been targeted in real-world extortion campaigns before, and the product’s complexity, thousands of interconnected modules built up over decades, makes comprehensive patch testing genuinely difficult for the enterprises that run it. That complexity is part of why some organizations fall multiple CSPU cycles behind, accumulating exposure with every missed release.
Market Impact: What This Means for CISOs and IT Budgets
A release of this size has real budget and staffing consequences beyond the immediate patching sprint. Vulnerability management teams now have to triage 672 individual CVEs against their own asset inventories, a task that alone can consume days of analyst time at large organizations running multiple Oracle product lines. Change-advisory boards at regulated industries, banking, healthcare, and government among them, typically cannot fast-track enterprise application patches the way they can operating-system updates, which stretches the actual remediation timeline well past the disclosure date.
There is also a compounding cost tied to Oracle’s new monthly cadence itself. Twelve patch cycles a year instead of four means twelve testing cycles, twelve change-control reviews, and twelve windows where something could break in production if a patch is rushed. Security teams that budgeted staff time around the old quarterly rhythm are now recalibrating for a workload that is roughly three times more frequent, even if any single monthly release were smaller than a quarterly one used to be. September’s release proves that assumption wrong on volume alone.
Historical Context: Two Decades of Oracle Patch Cycles
Oracle’s Critical Patch Update program traces back to the mid-2000s, when the company formalized a quarterly release schedule to give enterprise customers a predictable window for testing and deployment. That structure held for roughly twenty years across Database, Middleware, Java, and the applications suite, and it became one of the longest-running vendor patch programs in enterprise software. The move to monthly Critical Security Patch Updates in 2026 is the most significant change to that cadence since the program’s creation, and it mirrors a broader industry shift toward faster, smaller, more frequent patch cycles that Microsoft and other major vendors adopted years earlier with their own monthly Patch Tuesday programs.
The rationale behind the change is straightforward even if Oracle has not detailed it extensively in public materials: quarterly releases left a three-month gap during which newly discovered vulnerabilities sat unpatched, giving attackers a wide window to develop and deploy exploits before an official fix existed. Monthly releases shrink that window, in theory, though September’s numbers show the tradeoff is a much higher monthly volume for IT teams to absorb.
Industry Reaction to the September CSPU
Coverage from the major vulnerability intelligence vendors converged quickly around the same theme: scale. Tenable’s September 15 blog post framed the release around its per-family patch and exploitability breakdown, steering customers toward prioritizing Fusion Middleware and Hyperion given their high concentration of unauthenticated remote flaws. SecurityWeek’s September 16 report called it one of the largest security updates Oracle has shipped, and specifically flagged risk to internet-facing application servers and middleware as the top concern for readers. CybersecurityNews echoed that framing, describing the release as one of Oracle’s largest monthly security bundles to date and noting that more than 130 additional CVEs were quietly resolved through patches bundled for other flaws, on top of the 672 formally listed.
None of the coverage reviewed for this report ties any of the September CVEs to the CISA Known Exploited Vulnerabilities catalog, and no outlet named Rapid7 in connection with this specific release. That does not rule out federal attention later; KEV listings and CISA advisories sometimes follow vendor disclosures by days or weeks once exploitation is independently confirmed.
What Security Teams Should Prioritize This Week
Given the scale of this release, blanket patching everything at once is unrealistic for most organizations. A more practical sequence, based on the exploitability data outlets have published, looks like this:
- Patch CVE-2026-64849 immediately given confirmed active exploitation, regardless of which product family it sits in for a given environment.
- Treat the seven CVEs with public proof-of-concept code (CVE-2026-2332, CVE-2026-7598, CVE-2026-9563, CVE-2026-57220, CVE-2026-59943, CVE-2026-63308, CVE-2026-75838) as near-term priorities, since PoC availability historically precedes real-world attacks by days to weeks.
- Prioritize Fusion Middleware and Hyperion instances that are internet-facing, since those two product families carry the highest counts of unauthenticated remote-exploit flaws.
- Patch all three Java SE fixes without delay, since every single one is remotely exploitable without credentials.
- Inventory every E-Business Suite and Siebel CRM instance still in production, since both carry large patch counts tied to business-critical financial and CRM data.
- Build a recurring monthly review process rather than a quarterly one, since Oracle’s new cadence is not reverting to the old schedule.
- Run internet-facing Oracle applications through a structured API security testing process once patches are deployed, since middleware and E-Business Suite endpoints are common API attack surfaces.
Predictions: Where Oracle’s Patch Cadence Is Headed
Based on the trend visible across 2026’s monthly releases so far, a few outcomes look likely over the coming months.
- October’s CSPU will likely stay in the same elevated range as September rather than reverting to June’s lighter 35-flaw release, since the monthly model appears to be surfacing a backlog of previously unpatched issues.
- Expect at least one more CVE from this release to surface on CISA’s Known Exploited Vulnerabilities catalog within the next 30 to 60 days if exploitation of CVE-2026-64849 continues or spreads.
- Enterprises running older, unpatched E-Business Suite and Fusion Middleware deployments will remain a preferred target for ransomware and data-extortion groups through the rest of 2026, continuing a pattern already seen with other enterprise application vendors this year.
- Vulnerability management vendors like Tenable and Qualys will likely expand automated prioritization tooling specifically for Oracle’s monthly cadence, given how much manual triage 672 CVEs currently demands.
- Pressure will build on Oracle to publish clearer guidance distinguishing which of its 17 product families need emergency out-of-cycle patching versus which can wait for standard change-control windows, since treating all 673 patches with equal urgency is not realistic for most IT teams.
Frequently Asked Questions
How many vulnerabilities did Oracle patch in September 2026?
Oracle’s September 2026 Critical Security Patch Update includes 673 security patches covering 672 unique CVEs across 17 product families, with the effective total climbing past 800 vulnerabilities once additional bundled CVEs are counted, according to SecurityWeek and CybersecurityNews.
Is any Oracle CVE from September 2026 being actively exploited?
Yes. Hong Kong’s GovCERT reported that CVE-2026-64849, a remote code execution flaw, is being exploited in the wild, and flagged public proof-of-concept exploit code for seven additional CVEs.
Which Oracle products are most affected by the September 2026 update?
Oracle E-Business Suite (159 patches), Fusion Middleware (153 patches), and Hyperion (102 patches) carry the largest patch counts, according to Tenable’s per-family breakdown of the release.
Why did Oracle switch to a monthly patch schedule in 2026?
Oracle moved from a roughly two-decade-old quarterly Critical Patch Update model to monthly Critical Security Patch Updates starting in June 2026, releasing fixes on the third Tuesday of each month, according to CIO.com. The change shortens the window attackers have to exploit newly disclosed flaws before an official fix exists.
How does Oracle’s September update compare to Microsoft’s Patch Tuesday the same week?
Microsoft’s September 2026 Patch Tuesday fixed 966 flaws including two exploited zero-days, according to coverage aggregated by Integrity360, while Oracle’s CSPU fixed 673 patches covering 672 CVEs. Combined, the two releases added up to roughly 1,600 disclosed vulnerabilities from two vendors in a single week.
Is any September 2026 Oracle CVE listed on the CISA Known Exploited Vulnerabilities catalog?
No outlet reviewed for this report confirmed a CISA KEV listing tied to this specific release as of publication. CVE-2026-64849’s confirmed exploitation, reported by GovCERT Hong Kong, could still lead to a future KEV addition.
How many flaws in this release can be exploited without a login?
More than 240 of the 672 CVEs in the September 2026 CSPU are remotely exploitable without authentication, according to both SecurityWeek and CybersecurityNews, meaning attackers do not need valid credentials to attempt exploitation over a network.
What should IT teams do first after this release?
Security teams should patch CVE-2026-64849 immediately given confirmed active exploitation, then prioritize the seven CVEs with public proof-of-concept code, followed by internet-facing Fusion Middleware and Hyperion instances, which carry the highest concentration of unauthenticated remote-exploit flaws in this release.
