55
55
30
55
60
30
60
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.
38
60
60
60
42
30
55
30
60
February 2021 Patch Tuesday: Microsoft and Adobe fix exploited zero-days
60
30
60
60
60
60
42
VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.
CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.
55
47
60
30
60
55
30
35
42
55
60
35
60
30
60
60
55