Oracle August 2026 Patch Update Fixes 943 Flaws Amid Zero-Day Attacks

What Oracle shipped

Oracle's August 2026 Critical Security Patch Update (CSPU) contains 943 new security patches. The release came shortly after one zero-day campaign against its software had been confirmed and shortly before another exploited flaw was reported. The update went out on Tuesday, August 18. It was the company's third release under its new monthly patch schedule.18 SecurityWeek said the fixes cover more than 1,000 unique CVEs across about two dozen product families. More than 460 of those flaws can be exploited remotely without authentication.1

The severity numbers are high. More than 150 of the bugs are rated critical, and close to 90 have a CVSS score of 9.8 or above.1 Tenable counted 154 critical-rated patches, or 16.3% of the release. High-severity issues made up 59% and medium-severity issues 21%.8 At least one flaw has the maximum CVSS score of 10.0: CVE-2026-61241, in the LDAP Server component of Oracle Internet Directory.4 Several analysts said it should be fixed first.9

For anyone tracking active threats, the important point is that none of the August coverage reports a flaw in this release being exploited at the time of disclosure. Oracle's behaviour over the past few months shows why that statement only goes so far.

Where the patches landed

Fusion Middleware and Hyperion took the most fixes, with 262 patches each. Fusion Middleware had 80 critical-severity flaws and Hyperion had 27.1 The bigger worry is how many of them can be reached without credentials. Fusion Middleware has 182 such flaws and Hyperion has 107.18 E-Business Suite received 120 patches, Commerce 66, Siebel CRM 50 and Supply Chain 46.1 VirtualBox, PeopleSoft, MySQL, Database Server, Java SE, JD Edwards and more than a dozen other product lines also got fixes.13

WebLogic Server is a familiar problem again. Cybersecurity News reported a group of critical WebLogic flaws that reach the server core through the T3, IIOP and RMI protocols. These include CVE-2026-60698, CVE-2026-60672, CVE-2026-60696 and CVE-2026-60977, all rated 9.8, plus CVE-2026-60702 at 9.9. Each could let an unauthenticated remote attacker take over a server completely.4 Byteiota pointed out that Oracle administrators have seen this T3/IIOP pattern many times before.9 That matters because WebLogic is often exposed to the internet and attackers know these protocols well.

The database tier also needs attention. Secure-ISS listed CVE-2026-71064 in Oracle Portable Clusterware, rated 9.6. An attacker on an adjacent network could reach it over TLS with no credentials and no user interaction.2 The same write-up listed CVE-2026-60782, a 9.8 flaw in the File Transmission component of Oracle Payments that can be exploited over HTTP without authentication.2 Oracle Payments has been attacked before, which is covered below.

About 6% of the release, 53 patches, fixes CVEs in third-party code such as open-source components bundled into Oracle products, according to Qualys.6 Teams that manage risk by looking only at Oracle's own code will miss that part of their exposure.

The numbers do not agree

The coverage agrees on the 943 patch count but splits on most of the other figures. SecurityWeek describes more than 1,000 unique CVEs across "two dozen products."1 Tenable counts 925 unique CVEs across 23 product families.8 Fortra's research team also counts 925 CVEs, but puts the number of unauthenticated remote flaws at 451, compared with the 460-plus figure used elsewhere.101 Reported release dates run from August 18 to August 21.895

Some of this comes from what each outlet counts. SecurityWeek noted that some patches also fix additional security flaws, so counting every CVE gives a bigger total than counting the risk matrices alone.1 Other differences are actual mistakes. One widely shared summary lists 410 E-Business Suite patches and refers to "1,448 patches."7 Those figures match July's quarterly Critical Patch Update, which had 1,449 updates, more than the August release.120 One flaw on that summary's critical list, CVE-2026-60880 in E-Business Suite's Work in Process module, was flagged by NHS England as part of the July advisory.207 Another outlet says the August release had just 531 CVEs and 10 critical flaws.15 That is very different from the vulnerability-management vendors' counts, and those vendors' figures should be preferred.

The practical lesson is that defenders should check their patch scope against Oracle's own risk matrices and the vendor-level breakdowns, not against secondary summaries. The advisory has also changed since release. Oracle's security-alerts index lists the August CSPU at revision 4, dated September 4.14 Secure-ISS recorded an August 20 revision that narrowed the affected version range for a Database Server flaw, CVE-2026-71062.2

The zero-day backdrop

The August release only makes sense alongside what happened in June and July. On June 10, Oracle issued an out-of-band Security Alert for CVE-2026-35273, a remote code execution flaw in PeopleSoft PeopleTools.13 The next day, Google Threat Intelligence Group and Mandiant confirmed that the extortion group ShinyHunters (UNC6240) had already exploited it as a zero-day.13 More than 100 organizations were hit, and 68% of them were in higher education.17

Oracle's public statements trailed the threat intelligence. SecurityWeek reported that the June CSPU advisory mentioned CVE-2026-35273 without saying it had been exploited. Oracle had not confirmed the in-the-wild exploitation even after mitigating the flaw.18 Oracle's standard advisory language says attackers have succeeded "because targeted customers had failed to apply available Oracle patches."1811 That framing puts the blame on customers who are slow to patch. It does not fit well with a flaw that was being exploited before any patch existed.

The campaign kept going. Waratek's analysis of the July CPU said ShinyHunters was chaining CVE-2026-35273 with a second PeopleTools flaw, CVE-2026-35278, which was fixed in that release. The group claims to have compromised more than 300 PeopleSoft servers across more than 100 organizations.16 E-Business Suite has also been targeted after patches were released. CVE-2026-46817, a 9.8 flaw in Oracle Payments that was fixed in the first CSPU in May, was later reported as exploited. CISA added it to its Known Exploited Vulnerabilities catalog on July 15.1916

The pattern continued after August. Coverage of the September 15 CSPU cites Hong Kong's GovCERT as reporting that CVE-2026-64849 is being exploited in the wild, with public proof-of-concept code for seven more CVEs.15 One of those is CVE-2026-2332, a bundled Eclipse Jetty flaw15 that had already been listed with a 9.1 rating in earlier Oracle patch data.7

Why the monthly cadence matters

Oracle released fixes on a quarterly cycle for about two decades. It now ships patches on the third Tuesday of every month.157 Its monthly CSPUs are described as smaller, targeted, high-priority updates that sit alongside the quarterly cumulative CPUs, and the first one came out on May 28, 2026.14

The August release does not look small. Tenable calculated it as almost four times the volume of the June CSPU, which had 245 patches across 11 product families.8 The likely reason is that Oracle is now moving fixes out monthly, as soon as they are ready, instead of holding them for the next quarterly bundle. That shortens the time a fixed flaw sits unpatched, but customers now face more frequent large releases. Coverage of the September release described mid-September as one of the heaviest patching periods of the year, because Oracle's release landed the same week as a very large Microsoft Patch Tuesday.15 News4Hackers said AI-assisted vulnerability discovery is pushing the need for faster deployment.3 That explanation is reasonable, though the coverage does not show Oracle stating it.

How defenders should prioritize

The experience of the past few months points to a clear order. Confirmed exploitation should outrank CVSS score. Waratek made the same argument in July, noting that a confirmed attack on PeopleSoft carries more weight than a higher score with no known attacker activity.16 In August, with no confirmed exploitation reported for the new flaws, the next factor is exposure. That puts internet-facing Fusion Middleware first, especially WebLogic and Oracle Internet Directory, followed by Hyperion and E-Business Suite.48 Secure-ISS also advises restricting network access to exposed Oracle services until patching is finished, watching authentication logs, and upgrading unsupported releases, which cannot receive current fixes.2

The absence of a known zero-day in August should not be read as safety. Within a few months, Oracle disclosed a PeopleSoft flaw only after attackers were already using it, saw a patched E-Business Suite flaw exploited and added to the KEV catalog, and released a September update that already included a flaw reported as exploited.131915 With 943 patches and hundreds of flaws reachable without credentials, the August release has plenty of candidates for the next campaign, and attackers seem to go for whichever ones customers leave unpatched longest.