Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Brief
Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates.
Key Takeaways
- The September 2026 Critical Security Patch Update (CSPU) contains fixes for 672 unique CVEs in 673 security updates
- 104 issues (15.5% of all patches) were assigned a critical severity rating
- Oracle E-Business Suite received the highest number of patches at 159, accounting for 23.6% of all patches
Background
On September 15, Oracle released its Critical Security Patch Update (CSPU) for September 2026 . Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. This CSPU contains fixes for 672 unique CVEs in 673 security updates across 17 Oracle product families.