Oracle released 943 security patches on Tuesday as part of its August 2026 Critical Patch Update, fixing more than 1,000 unique vulnerabilities across two dozen products, including over 460 bugs that can be exploited remotely without authentication.
The update is Oracle’s third monthly security rollout and includes more than 150 critical-severity defects, with nearly 90 of them carrying a CVSS score of 9.8 or higher, the maximum severity tier. SecurityWeek first reported the figures on August 19.
Fusion Middleware and Hyperion Lead the Fixes
Fusion Middleware and Hyperion received the largest number of patches this month, at 262 each. Fusion Middleware alone accounts for 80 critical-severity flaws, 182 of which are remotely exploitable without credentials. Hyperion patches address 27 critical bugs and 107 weaknesses that can be attacked over the network.
E-Business Suite followed with 120 patches, Commerce with 66, Siebel CRM with 50, and Supply Chain with 46. Other affected products include VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, Java SE, and Retail Applications, among others.
AI-Driven Vulnerability Discovery Pushes Patch Counts Higher
The high volume of patches is likely driven by the use of artificial intelligence for vulnerability discovery. Oracle announced earlier this year that it was deploying advanced large language models to accelerate its patching pipeline, and the results are showing up in monthly totals. The August update follows the July 2026 Critical Patch Update, which included 1,449 patches addressing over 1,400 unique CVEs.
Oracle’s official advisory warned that threat actors continue to exploit previously patched vulnerabilities across its product line, urging customers to apply updates as soon as possible. The company noted it periodically receives reports of attempts to maliciously exploit flaws for which patches have already been released.
The scale of the update underscores the growing challenge facing enterprise security teams. With hundreds of critical bugs disclosed each month, organizations running large Oracle environments face mounting pressure to prioritize remediation before attackers weaponize known weaknesses. Security researchers have repeatedly warned that unpatched Oracle systems remain among the most targeted by both cybercriminal groups and state-sponsored actors.
The advisory comes amid a broader trend of surging vulnerability disclosures across the software industry, driven in part by AI-augmented security research. SecurityWeek has reported that AI-driven vulnerability discovery is breaking the traditional patching model, forcing vendors and enterprises to rethink how they manage remediation cycles.
Sources: SecurityWeek; Oracle Critical Patch Update advisory, August 2026; BleepingComputer
discussion