Oracle CSPU Delivers 673 Patches for 672 CVEs Across Enterprise Products

Oracle released its September 2026 Critical Security Patch Update with 673 patches addressing 672 CVEs across 17 product families, including 104 critical- and 503 high-severity fixes. Oracle E-Business Suite received 159 patches and Fusion Middleware received 153. The most severe disclosed issues include CVE-2026-73945 in Oracle Access Manager and CVE-2026-73948 in Oracle WebCenter Portal, both rated CVSS 9.9, and CVE-2026-60696 in Oracle WebLogic Server, rated 9.8; affected services can be remotely reachable with no authentication or limited privileges required.

The update also addresses high-severity takeover and data-access flaws in Hyperion Financial Management, GraalVM, and Oracle Purchasing. CVE-2026-87238 allows a low-privileged network attacker to take over Hyperion Financial Management 11.2.26.0.000 via SQL, while CVE-2026-87234, CVE-2026-87241, and CVE-2026-87245 can expose or alter critical application data. Multiple GraalVM compiler flaws, including CVE-2026-83357, CVE-2026-83408, CVE-2026-87286, and CVE-2026-87287, could allow unauthenticated HTTP-based compromise despite high exploitation complexity. No active exploitation was reported; organizations should prioritize internet-facing WebLogic, identity, middleware, GraalVM, and E-Business Suite systems and restrict WebLogic T3/IIOP exposure until patching is complete.