Oracle's August 2026 CSPU: prioritising 943 security patches without chaos

Oracle published its final August Critical Security Patch Update on 18 August 2026, covering 943 new security patches across a wide product set. The bulletin includes Oracle Database, Autonomous Health Framework, Essbase, E-Business Suite, Fusion Middleware, Hyperion, MySQL, Java SE, VirtualBox, PeopleSoft and Siebel. Oracle recommends staying on supported releases and applying security updates without delay.

The number 943 attracts attention, but it is not a deployment plan. One vulnerability may affect multiple products, and product matrices are not mutually exclusive buckets that can simply be added. A team needs to map product, release, component, required privilege, protocol and network reachability. Only then does the bulletin become a risk queue for its environment.

How CSPU differs from a quarterly CPU

Oracle presents the Critical Security Patch Update as a smaller, more targeted package of high-priority fixes that complements its quarterly Critical Patch Updates. The vendor moved to a more frequent security rhythm in 2026, but the core principle remains: the current package does not remove the need to review previous advisories and patch backlog.

Fixes cover Oracle code and third-party components embedded in products. A matrix may list a dependency CVE while also explaining through VEX that vulnerable code is not in an executable path for that product. An automated SBOM scanner may still alert. Administrators should reconcile scanner output with vendor evidence rather than dismissing it without documentation or treating every finding identically.

Oracle notes that it continues to see attempts against vulnerabilities for which patches already existed and that some attackers succeeded where customers had not applied them. That is a general case for urgency, not a claim that all 943 entries are actively exploited.

Oracle Database: 17 fixes across three groups

The Oracle Database Products section has 17 new fixes: six for Oracle Database Server, seven for Autonomous Health Framework and four for Essbase. Some database issues are remotely exploitable without authentication. Administrators must still examine the component, protocol and supported version range rather than assigning the highest score to every database instance.

Autonomous Health Framework often sits beside a critical database as a diagnostic utility. It is the sort of component omitted from a CMDB because no one calls it a separate business system. If it can read configuration, logs and host state broadly, its risk may exceed its user count.

Essbase receives four new fixes, three of which Oracle classifies as remotely exploitable without authentication. CVE-2026-29167 and CVE-2026-70689 reach 9.8 in the matrix. Not every organisation exposes Essbase publicly, but instances reachable from user, partner or VPN networks deserve high priority.

E-Business Suite: 120 fixes and dependencies

Oracle E-Business Suite receives 120 new security patches, with 27 potentially remotely exploitable without authentication. EBS is not one web application. It is an ecosystem of components, integrations, databases, middleware and client extensions. Looking only at the public login misses integration services, portals, queues and endpoints exposed internally.

Oracle advises EBS customers to apply the relevant Oracle Database and Fusion Middleware updates. Ordering matters: one component may require a minimum release of another, a newer JDK or configuration changes. A plan needs certified combinations, backups, a tested restore and validation of finance, HR and integration workflows.

After earlier EBS incidents, internet-facing elements warrant their own security zone. A reverse proxy or WAF may reduce some requests, but it does not repair code or cover every post-authentication path. If the maintenance window is distant, temporarily narrowing network sources and increasing logging is more defensible than marking the issue mitigated based on a WAF alone.

Fusion Middleware and Hyperion: volume with different entry points

Fusion Middleware has 262 new fixes, of which the summary says 182 may be remotely exploitable without authentication. The family includes WebLogic, Identity Manager, Access Manager, SOA, WebCenter, Internet Directory and file-transfer services. Products have different versions and protocols; the count should not be assigned to each WebLogic server.

Oracle Hyperion also has 262 new fixes, 107 described as remotely reachable without authentication. Matching counts do not mean an identical CVE set, nor can they be added blindly to the 943 headline. Hyperion often runs in a trusted finance network, but users, integrations and application servers create lateral paths. “Internal” is not the same as unreachable.

In both families, prioritise components published through reverse proxies, reachable from partner networks, holding privileged data sources or sharing technical identities. Check administrative servers and Node Manager instances that an external scan may not see.

MySQL, Java SE and broad dependencies

MySQL receives nine new fixes, five potentially remotely exploitable without authentication. The scope spans different products and utilities such as servers, clusters, connectors and the shell. A client package on a laptop and a production server release require separate decisions.

Java SE has five new fixes, four described by Oracle as remotely exploitable without authentication under the relevant conditions. Java is a runtime embedded in many products, so updating a system JDK does not necessarily replace a private runtime bundled with an application. Inventory must cover container images, application directories, management agents and JREs shipped by vendors.

Oracle Commerce contains 66 new fixes, 47 reachable without authentication. The bulletin also has substantial matrices for industry applications, supply chain, retail, financial services, PeopleSoft, Siebel and VirtualBox. Prioritisation cannot stop at databases and WebLogic merely because those names are most familiar.

Reading an Oracle risk matrix

Each row joins a CVE to its product, component, required package or privilege, protocol, unauthenticated remote status, CVSS result and supported affected releases. Oracle explains that the HTTP protocol label includes HTTPS. Transport encryption does not repair business logic, deserialisation or parser flaws.

“Remote Exploit without Auth?” is valuable, but “No” does not equal low risk. A weakness may require a low-privilege account obtained through phishing, password reuse or another vulnerability. In a multistage intrusion, local escalation and authenticated defects frequently form the middle of a chain.

Oracle tests and publishes fixes for supported releases. An old release absent from the supported range must not be assumed safe. It may contain the same code without receiving a patch or full assessment. The decision is then upgrade, isolate or formally accept risk with a retirement date.

A first-72-hours plan

On day one, retrieve the final advisory and its CSAF or text matrices, then reconcile products against CMDB, network discovery, SBOM and cloud accounts. Mark internet assets, privileged systems, regulated data and ownerless components. Do not rely only on hostnames; find Oracle Homes, inventory records, images and application versions.

Next validate patch availability and dependencies through My Oracle Support. Create change packages for each certified stack with rollback and restore tests. In high availability, cover every node, standby, disaster-recovery system and autoscaling template. A patched active node with a vulnerable recovery image does not close exposure.

Deploy in risk order:

1. unauthenticated paths from the internet and partner zones;
2. IAM, middleware and high-privilege service accounts;
3. databases and applications holding critical data;
4. internal components broadly reachable from user networks;
5. client and development tools plus images that can reintroduce the old release.

After change, confirm the version from the process or product inventory, run functional tests and rescan. A closed ticket is not proof. Evidence means a compliant release on every node and no vulnerable artefact in the redeployment mechanism.

Facts and conclusions

Counts, releases, unauthenticated-attack status and vendor recommendations come from Oracle’s final bulletin. Deployment ordering, recovery-image risk, CMDB correlation and WAF limitations are Breachroad analysis. We do not claim all 943 issues are actively exploited or that every one affects a given organisation.

A vulnerability-management programme should process a publication of this size without panic or months of delay. Cybersecurity training for IT teams creates a shared risk language, while an IT security audit can examine inventory completeness, change control, segmentation and deployment evidence.

Sources

• Oracle Critical Security Patch Update Advisory — August 2026
• Oracle Risk Matrix Definitions
• Oracle Critical Patch Updates and Security Alerts