Oracle has released its August 2026 Critical Security Patch Update (CSPU), addressing 925 unique Common Vulnerabilities and Exposures (CVEs) through 943 security updates across 23 of its product families. This update includes 154 critical severity patches, accounting for 16.3% of the total fixes.
The August CSPU marks a significant increase in volume compared to previous monthly CSPUs. For instance, the June 2026 CSPU included 245 patches for 243 CVEs across 11 product families. The current release's 943 patches represent approximately 65% of the volume seen in the July 2026 Critical Patch Update (CPU), which was the largest quarterly CPU of 2026 with 1,449 patches for 1,235 CVEs.
Oracle introduced CSPUs in May 2026 as a monthly release cycle designed to address high-severity issues more frequently, complementing the larger quarterly Critical Patch Updates. The expansion of the August CSPU to cover 23 product families, up from 11 in June, indicates a broader scope for these monthly releases.
Of the 943 security updates, 154 patches address critical vulnerabilities, corresponding to 151 unique CVEs. High-severity patches constitute the largest portion at 556, covering 541 CVEs, while medium-severity patches total 198, addressing 198 CVEs. Low-severity patches account for 35 fixes, resolving 35 CVEs.
The Oracle Fusion Middleware and Oracle Hyperion product families received the highest number of patches in this update, each with 262 fixes. This represents 27.8% of the total patches for each product family. A substantial number of these vulnerabilities can be exploited remotely without requiring authentication: 182 in Oracle Fusion Middleware and 107 in Oracle Hyperion.
Other product families significantly impacted include Oracle E-Business Suite with 120 patches (27 remote exploits without authentication), Oracle Commerce with 66 patches (47 remote exploits without authentication), and Oracle Siebel CRM with 50 patches (21 remote exploits without authentication). Oracle Supply Chain received 46 patches, 18 of which are remotely exploitable without authentication.
Smaller numbers of patches were issued for Oracle Virtualization (21 patches, 2 remote exploits), Oracle Analytics (16 patches, 3 remote exploits), Oracle PeopleSoft (15 patches, 7 remote exploits), Oracle Communications (13 patches, 9 remote exploits), Oracle Enterprise Manager (11 patches, 6 remote exploits), and Oracle MySQL (9 patches, 5 remote exploits).
Additional affected product families include Oracle Financial Services Applications (8 patches, 6 remote exploits), Oracle Autonomous Health Framework (7 patches, 2 remote exploits), Oracle Application Testing Suite (7 patches, 3 remote exploits), Oracle Database Server (6 patches, 4 remote exploits), Oracle JD Edwards (6 patches, 2 remote exploits), Oracle Java SE (5 patches, 4 remote exploits), Oracle Retail Applications (5 patches, 5 remote exploits), Oracle Essbase (4 patches, 3 remote exploits), Oracle Food and Beverage Applications (2 patches, 2 remote exploits), Oracle Construction and Engineering (1 patch, 1 remote exploit), and Oracle Hospitality Applications (1 patch, 1 remote exploit).
Patches for all affected products are available through the official Oracle August 2026 advisory.
