Oracle Critical Security Patch Update, September 2026 Review
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.
- 673 total patches: 104 critical, 503 high, 59 medium severity
- E-Business Suite tops the list with 159 patches, 19 unauthenticated-exploitable
- Fusion Middleware: 153 patches, 78 remotely exploitable without credentials
- 41 patches cover non-Oracle open-source components bundled in products
- Qualys QIDs 388778-388781, 87618, 20626 detect vulnerable assets
- CVEs
- CVE-2026-83154CVE-2026-83196CVE-2026-83197CVE-2026-83201CVE-2026-83202CVE-2026-83229CVE-2026-83268CVE-2026-83269CVE-2026-83282CVE-2026-83283CVE-2026-83327CVE-2026-83452CVE-2026-83462
- Tags
- critical-patch-updatedatabasee-business-suitefusion-middlewareoraclequalysvulnerability-management
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83154+4 related CVEs | Unauthenticated SOAP Data Access Flaw in Oracle Siebel CRM Open UI | 9.1 | — | ||
| CVE-2026-83197 | Unauthenticated Data Exposure & DoS in Oracle Siebel CRM Financial Services | 9.1 | — | ||
| CVE-2026-83268 | High-Privilege Takeover Flaw in Oracle BI Publisher (BI Platform Security) | 9.1 | — | ||
| CVE-2026-83269 | Unauthenticated Remote Takeover in Oracle BI Publisher (BI Platform Security) | 9.8 | — | ||
CVE-2026-83282+1 related CVE | Low-Privilege Takeover Flaw in Oracle BI Enterprise Edition 12.2.1.4.0 | 9.9 group max | — | ||
| CVE-2026-83327 | Unauthenticated SOAP Flaw in Oracle E-Business Suite Framework Allows Full Takeover | 9.8 | — | ||
| CVE-2026-83452 | Unauthenticated Takeover Flaw in Oracle EBS Document Management and Collaboration | 9.8 | — | ||
| CVE-2026-83462 | Unauthenticated Takeover in Oracle EBS Mobile Application Server (MWA Terminal Server) | 9.8 | — |
From the original article
2 min read at threatprotect.qualys.comOracle released its September edition of Critical Security Patch Update. The update received patches for 673 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.