Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families
Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.
Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).
- 673 patches across 17 product families; effective remediation total exceeds 800 CVEs including bundled third-party fixes.
- Fusion Middleware gets 153 patches with 78 remotely exploitable without authentication; E-Business Suite receives 159.
- Hyperion receives 102 patches, half unauthenticated; Siebel, Analytics, Communications and other families also patched.
- Oracle warns attackers exploit unpatched systems, citing CISA's 72-hour order for CVE-2026-21962 (CVSS 10.0).
- Defenders should prioritize internet-exposed Fusion Middleware, E-Business Suite, and Hyperion deployments.
- CVEs
- CVE-2026-21962
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21962 | Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in | 10.0 | 73% | KEV | KEV |
From the original article
3 min read at cybersecuritynews.com
Oracle has released one of its largest monthly security bundles to date, shipping 673 new security patches in its September 2026 Critical Security Patch Update (CSPU) to close serious flaws spanning its enterprise software portfolio. The advisory, published on September 15, spans 17 product families and includes more than 100 critical-severity vulnerabilities, with over 240 […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.