This Critical Security Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Security Patch Update for November 2026, which will be released on Tuesday, November 17, 2026. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Security Patch Update Advisory.
A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption. Critical Security Patch Updates complement Oracle’s existing quarterly cumulative Critical Patch Updates (CPUs). This Critical Security Patch Update addresses 652 new security patches. Some of the vulnerabilities addressed in this Critical Security Patch Update affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Security Patch Update patches as soon as possible.
This Critical Security Patch Update contains 7 new security patches for Oracle Database Products. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Database Server is 9.9.
The Oracle Database Server components and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 2 new security patches for Oracle APEX. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle APEX is 9.8.
The Oracle APEX products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 3 new security patches for Oracle Autonomous Health Framework. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Autonomous Health Framework is 9.1.
The Oracle Autonomous Health Framework products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 9 new security patches for Oracle REST Data Services. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle REST Data Services is 9.8.
The Oracle REST Data Services products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 3 new security patches for Oracle Application Testing Suite. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Application Testing Suite is 8.8.
The Oracle Application Testing Suite products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 6 new security patches for Oracle Commerce. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Commerce is 7.5.
The Oracle Commerce products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 28 new security patches for Oracle Communications. 18 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Communications is 9.8.
The Oracle Communications products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 2 new security patches for Oracle Construction and Engineering. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Construction and Engineering is 7.5.
The Oracle Construction and Engineering products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 72 new security patches for Oracle E-Business Suite. 22 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle E-Business Suite is 9.8.
The Oracle E-Business Suite products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 5 new security patches for Oracle Enterprise Manager. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Enterprise Manager is 9.1.
The Oracle Enterprise Manager products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 11 new security patches for Oracle Financial Services Applications. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Financial Services Applications is 7.5.
The Oracle Financial Services Applications products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 71 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Fusion Middleware is 10.0.
The Oracle Fusion Middleware products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 29 new security patches for Oracle Analytics. 9 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Analytics is 10.0.
The Oracle Analytics products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 267 new security patches for Oracle Hyperion. 107 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Hyperion is 9.9.
The Oracle Hyperion products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 11 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Java SE is 8.1.
The Oracle Java SE products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 1 new security patch for Oracle JD Edwards. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle JD Edwards is 6.5.
The Oracle JD Edwards products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 8 new security patches for Oracle MySQL. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.1.
The Oracle MySQL products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 13 new security patches for Oracle PeopleSoft. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle PeopleSoft is 9.3.
The Oracle PeopleSoft products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 19 new security patches for Oracle Siebel CRM. 9 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Siebel CRM is 8.8.
The Oracle Siebel CRM products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 74 new security patches for Oracle Supply Chain. 36 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Supply Chain is 9.9.
The Oracle Supply Chain products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are:
This Critical Security Patch Update contains 11 new security patches for Oracle Virtualization. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.
The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Virtualization is 8.6.
The Oracle Virtualization products and versions affected by vulnerabilities that are addressed in this Critical Security Patch Update are: