Oracle has released its August 2026 Critical Patch Update, addressing a total of 943 security vulnerabilities across its diverse product portfolio. The update includes patches for various product families, with some vulnerabilities impacting multiple products and incorporating fixes for third-party components.
Among the patched vulnerabilities, 53 are for non-Oracle CVEs, indicating issues within open-source components integrated into Oracle product distributions. Oracle Fusion Middleware and Oracle Hyperion received the highest number of patches in this cycle, each with 262 security updates.
For Oracle Fusion Middleware, 182 vulnerabilities are remotely exploitable without requiring user credentials, and 78 CVEs are rated as critical severity. Oracle Hyperion also saw 107 vulnerabilities that can be exploited over a network without authentication, with 27 CVEs deemed critical.
Oracle E-Business Suite received 120 security patches, 27 of which are remotely exploitable without user credentials. Notably, CVE-2026-60782 and CVE-2026-70926 in E-Business Suite are rated with a critical CVSS score of 9.8, and successful exploitation could lead to remote code execution.
Oracle Commerce was updated with 66 security patches, including 47 vulnerabilities that can be exploited over a network without user credentials, and 18 critical CVEs. Oracle Siebel CRM received 50 patches, with 21 vulnerabilities remotely exploitable without credentials and 10 critical CVEs.
The database product family received 17 updates. Oracle Database Server received six new security updates, with a maximum CVSS Base Score of 9.6. These updates do not apply to client-only deployments. Oracle Autonomous Health Framework received seven new security updates, with a maximum CVSS Base Score of 8.8. Oracle Essbase received four new security updates, with a maximum CVSS Base Score of 9.8.
Other product families covered in this Critical Patch Update include Oracle Application Testing Suite, Oracle Communications, Oracle Construction and Engineering, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Food and Beverage Applications, Oracle Analytics, Oracle Hospitality Applications, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Supply Chain, and Oracle Virtualization.
Security vendors have begun releasing coverage for these updates. For instance, Qualys has issued QIDs such as 87617 for Oracle WebLogic Server, 388372 for Oracle Managed Virtualization (VM) VirtualBox, 388371 for Oracle PeopleSoft Enterprise PeopleTools, 388370 for Oracle Java Standard Edition (SE), and 20609 for Oracle Database 19c. Additional QIDs are expected to be released as part of ongoing coverage.
