Oracle Releases 943 Security Patches to Fix Critical Vulnerabilities Across Enterprise Products

Oracle has released 943 security patches as part of its August 2026 Critical Security Patch Update (CSPU), addressing newly disclosed vulnerabilities across its enterprise software portfolio.

This update affects Oracle products under both Premier Support and Extended Support. It includes fixes for flaws tracked by various CVE identifiers.

Oracle Releases 943 Security Patches

The vulnerabilities are detailed in product-specific risk matrices, which identify the affected components, the prerequisites for exploitation, and the potential security impact.

Oracle uses CVSS v3.1 to score vulnerabilities, enabling organizations to prioritize remediation based on severity and exploit conditions relevant to their environments.

Several flaws fixed in the CSPU affect multiple Oracle products, which is why they appear under the same CVE ID across different risk matrices.

Notable CVEs mentioned in the advisory include CVE-2026-60884, CVE-2026-60392, CVE-2026-60590, CVE-2026-60591, CVE-2026-61308, CVE-2026-70906, CVE-2026-71062, CVE-2026-71073, CVE-2026-71079, CVE-2026-71084, and several vulnerabilities categorized under CVE-2026-711xx.

The update credits researchers from various organizations, including NCS Pte Ltd, Viettel Cyber Security, TrendAI Zero Day Initiative, Horizon3.ai, MongoDB, Octane Security, JeroScope, DEVCORE Research Team, and Team SaturnX.

Researchers Myeonghun Pak and Seongmin Kim from Team SaturnX were acknowledged for reporting a significant group of vulnerabilities, including CVE-2026-71127 through CVE-2026-71140.

Oracle strongly recommends that customers apply the latest CSPU patches as soon as possible due to the potential consequences of successful exploitation.

The vendor cautioned that temporary mitigations, such as blocking network protocols necessary for an attack or restricting unnecessary privileges, can reduce exposure but do not resolve the underlying vulnerabilities.

Such controls may also disrupt business applications, so validating them in non-production environments is crucial before deploying. Oracle emphasized that these mitigations should not be seen as a replacement for patching.

The advisory also notes that if HTTP is listed as an affected protocol in a risk matrix, HTTPS should generally be considered at risk as well, unless the secure protocol is specifically identified as the only impacted variant.

Security patches are issued only for Oracle releases covered by the company’s Premier Support or Extended Support lifecycle phases. Oracle warned that unsupported product versions have not been tested against the vulnerabilities addressed in the August 2026 CSPU and may also be affected by them.

Organizations running unsupported Oracle deployments should prioritize upgrades to supported versions before applying the latest fixes.

Enterprises that skipped previous patch cycles should also review earlier Oracle Critical Patch Update and Critical Security Patch Update advisories, as vulnerabilities fixed in prior releases may still be exploitable.

Additionally, Oracle listed third-party component vulnerabilities that it has determined are not exploitable within specific Oracle products.

These entries include Vulnerability Exploitability eXchange (VEX) justifications intended to assist security teams in distinguishing applicable third-party risks from non-exploitable dependencies.

Oracle’s next planned security releases are scheduled for September 15, October 20, November 17, and December 15, 2026.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC