/
← Voltar ao feed
high

Oracle September 2026 CSPU fixes 672 CVEs across 17 product families, 104 rated critical

1 fonte(s) · 1 atualização(ões) · publicado 15/09/2026 18:00 · coletado há 1 dia

On September 15, 2026, Oracle released its Critical Security Patch Update (CSPU) for September 2026, with 673 security updates covering 672 unique CVEs across 17 product families. Of these, 104 issues (15.5%) are rated critical, 503 high, 59 medium and 7 low. Oracle E-Business Suite received the most patches (159, 23.6%), followed by Oracle Fusion Middleware (153, 22.7%). Many of the flaws can be exploited over a network without authentication. The article does not report active exploitation. CSPUs are a monthly release cycle introduced in May 2026 that sits between the larger quarterly Critical Patch Updates.

Technical Details

  • Severity breakdown: 104 critical, 503 high, 59 medium, 7 low (673 patches, 672 unique CVEs).
  • Patch counts by family: E-Business Suite 159, Fusion Middleware 153, Hyperion 102, Siebel CRM 63, Analytics 50, Communications 31, Commerce 27, Supply Chain 19, Virtualization 19, PeopleSoft 16, Database Server 11, Enterprise Manager 7, Financial Services Applications 6, Application Testing Suite 3, Java SE 3, Autonomous Health Framework 2, Utilities Applications 2.
  • The Tenable table also lists how many vulnerabilities per family are remotely exploitable without authentication, for example 19 in E-Business Suite, 78 in Fusion Middleware and 26 in Siebel CRM.
  • The article does not list individual CVE identifiers.

Remediation

  • Apply the patches in the Oracle Critical Security Patch Update Advisory - September 2026.
  • Prioritize internet-exposed systems and products with unauthenticated network-exploitable flaws, such as E-Business Suite, Fusion Middleware and Siebel CRM.
  • Use the Tenable plugins, which are released progressively, to identify affected assets.

Linha do tempo

  1. tenable.com ↗ · pub. 15/09/2026 18:00 · coletado 19/10 18:00 primeiro registro

    Oracle September 2026 CSPU fixes 672 CVEs across 17 product families, 104 rated critical

    ler a análise desta fonte

    On September 15, 2026, Oracle released its Critical Security Patch Update (CSPU) for September 2026, with 673 security updates covering 672 unique CVEs across 17 product families. Of these, 104 issues (15.5%) are rated critical, 503 high, 59 medium and 7 low. Oracle E-Business Suite received the most patches (159, 23.6%), followed by Oracle Fusion Middleware (153, 22.7%). Many of the flaws can be exploited over a network without authentication. The article does not report active exploitation. CSPUs are a monthly release cycle introduced in May 2026 that sits between the larger quarterly Critical Patch Updates.

    Technical Details

    • Severity breakdown: 104 critical, 503 high, 59 medium, 7 low (673 patches, 672 unique CVEs).
    • Patch counts by family: E-Business Suite 159, Fusion Middleware 153, Hyperion 102, Siebel CRM 63, Analytics 50, Communications 31, Commerce 27, Supply Chain 19, Virtualization 19, PeopleSoft 16, Database Server 11, Enterprise Manager 7, Financial Services Applications 6, Application Testing Suite 3, Java SE 3, Autonomous Health Framework 2, Utilities Applications 2.
    • The Tenable table also lists how many vulnerabilities per family are remotely exploitable without authentication, for example 19 in E-Business Suite, 78 in Fusion Middleware and 26 in Siebel CRM.
    • The article does not list individual CVE identifiers.

    Remediation

    • Apply the patches in the Oracle Critical Security Patch Update Advisory - September 2026.
    • Prioritize internet-exposed systems and products with unauthenticated network-exploitable flaws, such as E-Business Suite, Fusion Middleware and Siebel CRM.
    • Use the Tenable plugins, which are released progressively, to identify affected assets.