60
Oracle Critical Security Patch Update, September 2026 Review
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.
55
60
60
55
Oracle’s September patches put Fusion Middleware back in the hot seat
Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.
Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.
65
60
60
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.
38
55
57
60
60
55
30
30
30
60
60
55
30
60
30
30
55
55
55
30
30
55
30
30
30
55
30
30
30
60
55
57