Oracle ships record CPU with 1,235 CVEs, including critical E-Business Suite flaws

Oracle released its largest-ever Critical Patch Update, fixing 1,235 unique CVEs with 1,449 patches across 32 product families, including 261 critical patches. Oracle E-Business Suite received the highest volume with 410 patches, while Fusion Middleware received 355; Oracle also highlighted numerous vulnerabilities that are remotely exploitable over a network without authentication in product lines such as Fusion Middleware, Oracle Communications, and E-Business Suite. Separate reporting said the update includes 18 critical Fusion Middleware vulnerabilities with CVSS scores up to 10.0, affecting products such as Oracle HTTP Server, WebLogic Server, Coherence, Data Integrator, Unified Directory, and Access Manager, with several flaws posing particular risk to internet-facing systems.

The E-Business Suite fixes include multiple high-severity vulnerabilities that could allow takeover, data theft, or unauthorized data changes across business applications. Notable examples include CVE-2026-62549 in Oracle HRMS (UK) (CVSS 9.6), CVE-2026-62546 and CVE-2026-62534 in Oracle Applications Framework (CVSS 9.1 and takeover risk), and CVE-2026-62547 in Oracle Workflow, where an unauthenticated attacker with SMTP access could compromise the Workflow Notification Mailer. Additional flaws affect Oracle Time and Labor, Flow Manufacturing, Yard Management, Public Sector Financials, Public Sector Payroll, Installed Base, Process Manufacturing Regulatory Management, HRMS (France), and Demantra Demand Management, with many described as easily exploitable over HTTP or SQL by low-privileged attackers and capable of exposing or modifying critical enterprise data.