Oracle on Tuesday announced the release of 943 new security patches as part of the August 2026 Critical Security Patch Update (CSPU), its third monthly security rollout.
The company’s advisory mentions more than 1,000 unique CVEs across two dozen products, including over 460 vulnerabilities that can be exploited remotely without authentication. The patches for dozens of vulnerabilities address additional security flaws.
More than 150 of the security defects are critical-severity bugs, and nearly 90 of them have a CVSS score of 9.8 or higher.
Fusion Middleware and Hyperion received the largest number of new security patches this month, at 262 each, including over 100 critical-severity flaws (80 and 27, respectively).
Per Oracle’s advisory, the Fusion Middleware update resolves 182 bugs that can be exploited remotely without authentication, while the Hyperion refresh patches 107 such weaknesses.
Oracle also released a large number of patches for E-Business Suite (120), Commerce (66), Siebel CRM (50), and Supply Chain (46).
Other products that received fixes this month include VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, Financial Services Applications, Autonomous Health Framework, Application Testing Suite, JD Edwards, Database Server, Java SE, Retail Applications, Essbase, Food and Beverage Applications, Construction and Engineering, and Hospitality Applications.
With over 1,000 resolved security defects, the August 2026 CSPU falls slightly behind the July 2026 Critical Patch Update, which included 1,449 security patches that addressed over 1,400 unique CVEs.
The high number of patches is likely driven by the use of AI for vulnerability discovery. Oracle announced earlier this year that it was using advanced LLM models to speed up patching.
Oracle customers are advised to apply the security updates as soon as possible, as threat actors have been known to exploit vulnerabilities in Oracle products.
“Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” the company notes.
Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
Related: Recent macOS Screen Sharing Vulnerability Exploited in Attacks
Related: Hackers Exploiting Unpatched GeoServer Zero-Day
Related: Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
