Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs
Brief
Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates.
Key Takeaways
- The August 2026 Critical Security Patch Update (CSPU) contains fixes for 925 unique CVEs in 943 security updates
- 154 issues (16.3% of all patches) were assigned a critical severity rating
- Oracle Fusion Middleware received the highest number of patches at 262, accounting for 27.8% of all patches
Background
On August 18, Oracle released its Critical Security Patch Update (CSPU) for August 2026 . Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence.