Oracle Critical Security Patch Update Advisory

Oracle Critical Security Patch Update Pre-Release Announcement - September 2026

Description

This Critical Security Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Security Patch Update for September 2026, which will be released on Tuesday, September 15, 2026. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Security Patch Update Advisory.

A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption. Critical Security Patch Updates complement Oracle’s existing quarterly cumulative Critical Patch Updates (CPUs). This Critical Security Patch Update addresses 714 new security patches. Some of the vulnerabilities addressed in this Critical Security Patch Update affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Security Patch Update patches as soon as possible.

Executive Summaries

Oracle Database Server Executive Summary

This Critical Security Patch Update contains 11 new security patches for Oracle Database Products. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 2 of these patches are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Database Server is 8.8.

The Oracle Database Server components and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Database Server, versions 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3

Oracle Autonomous Health Framework Executive Summary

This Critical Security Patch Update contains 4 new security patches for Oracle Autonomous Health Framework. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Autonomous Health Framework is 7.5.

The Oracle Autonomous Health Framework products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Autonomous Health Framework, versions 26.2, 26.3.1, 26.5.3, 26.8

Oracle Essbase Executive Summary

This Critical Security Patch Update contains 37 new security patches for Oracle Essbase. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Essbase is 9.9.

The Oracle Essbase products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Essbase, version 21.8.3.0.0

Oracle Application Testing Suite Executive Summary

This Critical Security Patch Update contains 3 new security patches for Oracle Application Testing Suite. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Application Testing Suite is 9.1.

The Oracle Application Testing Suite components and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Application Testing Suite, version 13.3.0.1

Oracle Commerce Executive Summary

This Critical Security Patch Update contains 27 new security patches for Oracle Commerce. 16 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Commerce is 8.2.

The Oracle Commerce products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Commerce Guided Search / Oracle Commerce Experience Manager, version 11.4.0

Oracle Communications Executive Summary

This Critical Security Patch Update contains 31 new security patches for Oracle Communications. 23 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Communications is 9.8.

The Oracle Communications products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 25.2.201, 26.1.200
Oracle Communications MetaSolv Solution Module - ASR, version 70.0.0
Oracle Communications Operations Monitor, version 6.1
Oracle Communications Service Catalog and Design, versions 8.0-8.3
Oracle Communications Unified Assurance, versions 6.1.1-7.0.0

Oracle E-Business Suite Executive Summary

This Critical Security Patch Update contains 159 new security patches for Oracle E-Business Suite. 19 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle E-Business Suite is 9.8.

The Oracle E-Business Suite products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle E-Business Suite, versions 12.2.3-12.2.15, V16

Oracle Enterprise Manager Executive Summary

This Critical Security Patch Update contains 7 new security patches for Oracle Enterprise Manager. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Enterprise Manager is 9.8.

The Oracle Enterprise Manager products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Enterprise Manager Base Platform, versions 13.5, 24.1
Oracle Enterprise Manager for Fusion Middleware, versions 13.5, 24.1
Oracle Enterprise Manager for Oracle Database, version 24.1

Oracle Financial Services Applications Executive Summary

This Critical Security Patch Update contains 6 new security patches for Oracle Financial Services Applications. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Financial Services Applications is 8.0.

The Oracle Financial Services Applications products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Banking Branch, versions 14.5.0.0.0-14.9.0.0.0
Oracle Banking Corporate Lending, versions 14.5.0.0.0-14.9.0.0.0
Oracle Banking Corporate Lending Process Management, versions 14.5.0.0.0-14.9.0.0.0
Oracle Banking Origination, versions 14.5.0.0.0-14.9.0.0.0
Oracle Banking Treasury Management, versions 14.5.0.0.0-14.9.0.0.0

Oracle Fusion Middleware Executive Summary

This Critical Security Patch Update contains 153 new security patches for Oracle Fusion Middleware. 78 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Fusion Middleware is 10.0.

The Oracle Fusion Middleware products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Fusion Middleware Control, versions 12.2.1.4.0, 14.1.2.0.0
Helidon, versions 3.0.0-3.2.20, 4.0.0-4.5.4
Oracle Access Manager, versions 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0
Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Oracle Data Integrator, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Forms, versions 12.2.1.19.0, 14.1.2.0.0
Oracle Identity Manager, versions 12.2.1.4.0, 14.1.2.1.0
Oracle Identity Manager Connector, versions 12.2.1.4.0, 14.1.2.1.0
Oracle Internet Directory, versions 12.2.1.4.0, 14.1.2.1.0
Oracle JDeveloper, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Managed File Transfer, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Middleware Common Libraries and Tools, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Oracle Platform Security for Java, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Web Services Manager, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Content, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Enterprise Capture, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Portal, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Sites, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Service Delivery Platform, versions 12.2.1.4.0, 14.1.2.0.0

Oracle Analytics Executive Summary

This Critical Security Patch Update contains 50 new security patches for Oracle Analytics. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Analytics is 9.9.

The Oracle Analytics products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle BI Publisher, versions 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0
Oracle Business Intelligence Enterprise Edition, versions 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0

Oracle Hyperion Executive Summary

This Critical Security Patch Update contains 104 new security patches for Oracle Hyperion. 52 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Hyperion is 10.0.

The Oracle Hyperion products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Hyperion Data Relationship Management, version 11.2.26.0.0
Oracle Hyperion Financial Management, version 11.2.26.0.0
Oracle Hyperion Profitability and Cost Management, version 11.2.26.0.0

Oracle Java SE Executive Summary

This Critical Security Patch Update contains 3 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Java SE is 8.1.

The Oracle Java SE products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle GraalVM Enterprise Edition, version 21.3.19.1
Oracle GraalVM for JDK 17, version 23.0.13.1
Oracle GraalVM for JDK 21, version 23.1.12.1

Oracle PeopleSoft Executive Summary

This Critical Security Patch Update contains 16 new security patches for Oracle PeopleSoft. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle PeopleSoft is 8.8.

The Oracle PeopleSoft products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

PeopleSoft Enterprise CC Common Application Objects, version 9.2
PeopleSoft Enterprise FIN Engineering Brazil, version 9.1
PeopleSoft Enterprise FIN Inventory Brazil, version 9.1
PeopleSoft Enterprise PeopleTools, versions 8.61-8.63
PeopleSoft Enterprise PRTL Interaction Hub, version 9.1

Oracle Siebel CRM Executive Summary

This Critical Security Patch Update contains 63 new security patches for Oracle Siebel CRM. 26 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Siebel CRM is 9.1.

The Oracle Siebel CRM products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Siebel Applications, versions 17.0-26.7

Oracle Supply Chain Executive Summary

This Critical Security Patch Update contains 19 new security patches for Oracle Supply Chain. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Supply Chain is 9.8.

The Oracle Supply Chain products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Agile Engineering Data Management, version 6.2.1
Oracle Agile PLM, version 9.3.6
Oracle Agile PLM MCAD Connector, version 3.6
Oracle Product Lifecycle Analytics, version 3.6.1

Oracle Utilities Applications Executive Summary

This Critical Security Patch Update contains 2 new security patches for Oracle Utilities Applications. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Utilities Applications is 8.2.

The Oracle Utilities Applications products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle Utilities Network Management System, versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 25.12.0.0.0-25.12.0.0.3

Oracle Virtualization Executive Summary

This Critical Security Patch Update contains 19 new security patches for Oracle Virtualization. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Virtualization is 8.6.

The Oracle Virtualization products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:

Oracle VM VirtualBox, version 7.2.16