Oracle Critical Security Patch Update, September 2026 Review

Oracle's September Critical Security Patch Update addresses 673 vulnerabilities across its product portfolio — 104 rated critical, 503 important, and 59 medium — with heavy patching for Oracle E-Business Suite, Fusion Middleware, and Hyperion. The bulletin highlights multiple remotely exploitable issues (several without authentication) including CVEs with CVSS scores up to 9.8, lists product-wise patch counts, and references Qualys QIDs; no evidence of active exploitation is provided, so organizations should prioritize deployment of these patches based on severity and remote exploitability.