Oracle released its September 2026 Critical Patch Update with fixes for more than 800 vulnerabilities across 17 product families, affecting organizations that run Oracle business software and infrastructure. Oracle says the update includes 673 new patches, 672 unique CVEs in the published risk matrices, more than 100 critical-severity flaws, and over 240 bugs that can be exploited remotely without authentication, with major patch volumes for E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, Commerce, Supply Chain, Virtualization, and PeopleSoft.
Why it matters: Organizations using Oracle products should review and deploy these patches quickly because many flaws can be attacked over the network without logging in. Even though Oracle did not say these issues are being exploited yet, its products are frequent targets and the update spans core business systems.
Ionut Arghire
2026.09.16
100% relevant
This article establishes a new monthly Oracle patch-cycle story for the September 2026 Critical Patch Update, distinct from previously tracked Oracle July and August 2026 update stories.
← Back to all stories