Oracle released 943 security patches in its August 2026 Critical Security Patch Update, fixing over 1,000 vulnerabilities across two dozen products including 460 remotely exploitable bugs and nearly 90 critical-severity flaws scoring 9.8 or higher on the CVSS scale.
The release marks Oracle’s third monthly security rollout of the year and arrives just weeks after the company patched over 1,400 vulnerabilities in its July update, reflecting an accelerating cadence of security fixes driven in part by AI-assisted vulnerability discovery across Oracle’s sprawling product portfolio.
Fusion Middleware and Hyperion Bear the Brunt
Fusion Middleware and Hyperion each received 262 patches in the August update, the largest allocations of any product family. Fusion Middleware’s fixes addressed 80 critical-severity flaws, 182 of which can be exploited remotely without authentication. Hyperion received 27 critical-severity patches and 107 patches for remotely exploitable vulnerabilities.
Oracle E-Business Suite received 120 patches, including CVE-2026-60782 and CVE-2026-70926, both critical-severity vulnerabilities with CVSS scores of 9.8 that could allow remote code execution. Oracle Commerce received 66 patches, with 47 exploitable over a network without credentials and 18 rated critical. Oracle Siebel CRM rounded out the top affected products with 50 patches, 21 remotely exploitable and 10 critical.
Other patched products include VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, Financial Services Applications, Retail Applications, Database Server, Java SE, and JD Edwards. Notably, 53 of the 943 patches addressed non-Oracle CVEs for open-source components embedded within Oracle product distributions.
AI-Driven Discovery Accelerates Patch Volume
The high volume of patches is partly attributed to Oracle’s use of advanced large language models to accelerate vulnerability discovery. The company announced earlier this year that it had deployed AI tools to speed up its patching process, a move that has significantly increased the number of defects found and addressed in each release cycle.
Oracle’s advisory warned that the company continues to receive reports of active exploitation attempts against previously patched vulnerabilities, making timely application of the August updates critical for organizations running Oracle products. The Cyber Resilience Act, which imposes reporting obligations starting September 11, 2026, adds regulatory pressure for organizations to maintain current patch levels across their Oracle deployments.
Sources: SecurityWeek; Oracle Security Advisory; Qualys; The Hacker News
discussion