Oracle’s September patches put Fusion Middleware back in the hot seat
Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.
Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.
- 673 new security patches spanning 17 Oracle product families
- Six CVSS 10.0 flaws remotely exploitable without authentication
- 13 additional CVSS 9.9 Fusion Middleware bugs require low privileges
- Oracle shifted from quarterly to monthly patching cadence
- Oracle warns of ongoing attacks on customers who skipped prior fixes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-71133+2 related CVEs | Unauthenticated Takeover Flaw in Oracle Access Manager Authentication Engine (CVSS 10.0) | 10.0 group max | — | ||
CVE-2026-73948+2 related CVEs | Authenticated Takeover Flaw in Oracle WebCenter Portal Composer | 9.9 | — | ||
CVE-2026-82997+2 related CVEs | Low-Privilege Takeover in Oracle Service Delivery Platform via T3/IIOP | 9.9 | — | ||
| CVE-2026-83020 | Unauthenticated Takeover Flaw in Oracle Platform Security for Java (Fusion Middleware) | 10.0 | — | ||
CVE-2026-83021+1 related CVE | Unauthenticated HTTP Takeover Flaw in Oracle WebLogic Server Web Container | 10.0 group max | — | ||
CVE-2026-83055+3 related CVEs | Low-Privilege LDAP Flaw Enables Full Takeover of Oracle Internet Directory | 9.9 | — | ||
| CVE-2026-83059 | Unauthenticated LDAP Flaw Allows Full Takeover of Oracle Internet Directory | 10.0 | — | ||
| CVE-2026-83099 | Unauthenticated HTTP Takeover of Oracle Forms in Fusion Middleware (CVSS 10.0) | 10.0 | — | ||
| CVE-2026-87230 | Unauthenticated Critical Flaw in Oracle Hyperion Financial Management Security Component | 10.0 | — |
From the original article
2 min read at csoonline.com
Oracle’s September 2026 Critical Security Patch Update has arrived with 673 new security patches spanning 17 Oracle product families, with Oracle E-Business Suite accounting for the largest share at 159 patches, followed by Fusion Middleware with 153. Of these, 19 E-Business Suite vulnerabilities and 78 Fusion Middleware vulnerabilities can be remotely exploited without authentication.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.