Oracle on Tuesday announced the release of 943 new security patches as part of the August 2026 Critical Security Patch Update (CSPU), its third monthly security rollout.
The company’s advisory mentions more than 1,000 unique CVEs across two dozen products, including over 460 vulnerabilities that can be exploited remotely without authentication. The patches for dozens of vulnerabilities address additional security flaws.
More than 150 of the security defects are critical-severity bugs, and nearly 90 of them have a CVSS score of 9.8 or higher.
Fusion Middleware and Hyperion received the largest number of new security patches this month, at 262 each, including over 100 critical-severity flaws (80 and 27, respectively).
Per Oracle’s advisory, the Fusion Middleware update resolves 182 bugs that can be exploited remotely without authentication, while the Hyperion refresh patches 107 such weaknesses.
Oracle also released a large number of patches for E-Business Suite (120), Commerce (66), Siebel CRM (50), and Supply Chain (46).
Other products that received fixes this month include VM VirtualBox, Analytics, PeopleSoft, Communications, Enterprise Manager, MySQL, Financial Services Applications, Autonomous Health Framework, Application Testing Suite, JD Edwards, Database Server, Java SE, Retail Applications, Essbase, Food and Beverage Applications, Construction and Engineering, and Hospitality Applications.