Oracle September 2026 Patch Update Fixes 800+ Flaws, 104 Critical

A record-scale monthly release

In September, Oracle released one of the largest security bundles it has ever put out between its quarterly updates. The September 2026 Critical Security Patch Update (CSPU) came out on September 15 with 673 new patches. The advisory lists 672 unique CVEs across 17 product risk matrices.1719 Those numbers understate the scope. Oracle says patches built for other flaws also resolve more than 130 additional CVEs, which brings the total number of vulnerabilities fixed past 800.1912

Severity is the bigger story. Qualys counted 104 of the 673 updates as critical, about 15.5%. It rated 503 as important and 59 as medium.20 Tenable's breakdown also put the critical count at 104.11 More than 240 of the flaws can be exploited remotely without authentication, meaning an attacker needs no valid credentials to try them over a network.1714 Fortra's analysis puts that figure at 246 of the 672 listed CVEs.11

The reporting agrees on the basic numbers. Where coverage differs is on how urgent the release is, and that difference is the most useful part of the story for anyone doing threat intelligence.

Where the fixes landed

Oracle E-Business Suite got the most patches, 159 in total, about 24% of the release. Nineteen of those address flaws exploitable remotely without login.20 Fusion Middleware came next with 153 patches. Seventy-eight of its flaws can be reached without authentication, and Qualys counted 67 critical-rated CVEs across Fusion Middleware products.20 Hyperion was third with 102 patches, 50 of them remotely exploitable without credentials.1920

Further down the list were Siebel CRM (63 patches), Analytics (50), Communications (31), Commerce (27), Supply Chain and Virtualization (19 each), and PeopleSoft (16).17 Oracle Database Server was a relatively small part of the release. It got 11 updates with a maximum CVSS base score of 8.8, and two of those apply only to client-only deployments.20

Communications is the outlier. About half of its 31 patches resolve more than 125 additional CVEs, mostly in bundled third-party components.19 Qualys found that 41 of the 673 patches, around 6%, fix non-Oracle CVEs in open-source components that ship inside Oracle products.20 This is a real problem for asset inventories. Many organizations that think they are tracking "Oracle risk" are actually tracking risk in third-party libraries they never chose and may not know they run.

Java SE received only three patches, but all three can be exploited remotely without credentials.1120 Given how widely Java runs across enterprise systems, a short list does not mean a small risk.

The exploitation question: where reporting diverges

The coverage disagrees on whether any of these flaws were already being exploited. Oracle's advisory, as reported by several outlets, does not say any of the newly patched September vulnerabilities were exploited in the wild.1719 Threat-intelligence aggregators that summarized the SecurityWeek report said the same: no current evidence of in-the-wild exploitation for these specific flaws.14

A later analysis from Tech Insider disagrees. It cites an alert from Hong Kong's government cybersecurity response team, GovCERT, which reportedly said a remote code execution flaw tracked as CVE-2026-64849 was under active exploitation. The same piece says GovCERT named seven more CVEs with public proof-of-concept code: CVE-2026-2332, CVE-2026-7598, CVE-2026-9563, CVE-2026-57220, CVE-2026-59943, CVE-2026-63308 and CVE-2026-75838.11

The two accounts can both be accurate. Oracle's statement describes what the vendor knew when it published. A government CERT's alert can reflect later telemetry or third-party reports. Still, defenders should read the gap carefully. Oracle not confirming exploitation is not the same as there being no exploitation. A responsible patch plan should treat the flagged CVE and the seven with public exploit code as top priorities until someone shows otherwise.

Oracle's own wording supports that caution. The company repeated its standard warning that attackers have succeeded in some cases because customers had not applied patches that were already available. It urged customers to stay on supported versions and patch without delay.1719

Why the patch-to-exploit window matters

Recent history shows how fast Oracle flaws get turned into weapons. Researcher gregk4sec reported the path-traversal issue behind CVE-2026-21962, an Oracle WebLogic proxy flaw, on September 24, 2025. A working proof-of-concept appeared on GitHub on January 22, 2026, two days after Oracle released the fix.6 Later reporting linked that flaw to China-associated attacks against more than 100 governments.6 CloudSEK honeypot data also caught exploitation attempts against much older WebLogic bugs, including CVE-2020-14882, CVE-2020-14883, CVE-2020-2551 and CVE-2017-10271.6

That pattern explains why the 240-plus unauthenticated flaws matter so much. Middleware connects web-facing applications to backend databases. A compromise there can become a route into much more sensitive systems.11 For organizations that hold customer or financial records in E-Business Suite or Hyperion, an unpatched middleware flaw is a direct path to a data breach. Old WebLogic bugs still being targeted years later show that attackers keep probing long after the patch ships.

A new cadence, and conflicting accounts of it

The September release is also notable because it is part of a changed schedule. For about two decades, Oracle shipped Critical Patch Updates quarterly.11 Accounts of the new model differ. CybersecurityNews says the CSPU began in May 2026 as a targeted, high-priority release designed for minimal disruption. In that telling, it ships on the third Tuesday of February, March, May, June, August, September, November and December, filling the months between the cumulative quarterly CPUs in January, April, July and October.19 Tech Insider instead describes a full move to monthly CSPUs starting in June 2026.11

The October release points to the first account. Oracle published a quarterly-style October 2026 Critical Patch Update advisory, which suggests the quarterly program continues alongside the new monthly releases.1 Either way, the main point holds. Oracle wants to shorten the time known vulnerabilities sit unpatched in customer systems.19 The cost is that security teams now face a much heavier patching workload.

The volume trend is clear. Reported figures show 35 flaws with 11 critical in June, 531 CVEs with 10 critical in August, and 672 CVEs with 104 critical in September.11 The September CSPU also landed in the same week as a Microsoft Patch Tuesday that reportedly fixed 966 flaws, including two exploited zero-days. Together, the two vendors disclosed roughly 1,600 vulnerabilities in a single week.11

October raised the stakes again

The October release made September look moderate. Oracle's October 2026 CPU, released on October 20, includes 1,295 security patches for 1,209 unique CVEs across 33 product families, according to Tenable's analysis.3 SecurityWeek, also citing Tenable, reported 95 critical, 439 high and 582 medium-severity CVEs.2 Another breakdown counted 112 critical patches covering those 95 critical CVEs.10 Fusion Middleware again got the most fixes: 206, of which 134 can be exploited remotely without authentication.2

Six October flaws carry the maximum CVSS score of 10.0, and all can be exploited remotely without credentials. They affect the E-Business Suite Workflow Notification Mailer (CVE-2026-101809), Oracle Access Manager (CVE-2026-87337), three SOA Suite issues (CVE-2026-91231, CVE-2026-91216, CVE-2026-91221) and JD Edwards EnterpriseOne Orchestrator (CVE-2026-91299).37 Fortra says the Access Manager flaw could let an attacker create, delete or change all data the product can reach over HTTP.4 WebLogic Server also has two 9.8-rated Core flaws, CVE-2026-91323 and CVE-2026-83399.9 Oracle's risk matrices list 562 October entries that can be exploited remotely without credentials.7

For now, none of the October flaws is marked as exploited in the wild, and no confirmed public proof-of-concept code exists.6 Separately, Oracle published an advisory for CVE-2026-91403, its Java response to the eMudhra weak-key incident.2

The takeaway

The September release should not be treated as routine. More than 800 vulnerabilities fixed, 104 rated critical, and over 240 reachable without credentials make it a major event. The disputed exploitation status is a reason to move faster, not to wait. The WebLogic case showed working exploits can appear within days of a patch. October's even larger release and its six perfect-score flaws make the direction clear: there are now more Oracle patches, released more often. Enterprises that still plan Oracle patching around quarterly change windows are now the most exposed, because attackers are moving faster than that schedule allows.