Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New. | UpGuard

Oracle's July 2026 Critical Patch Update disclosed 1,449 patches (1,461 CVEs) — a 3.7x jump over its 2021–2025 quarterly average and an abrupt tenfold increase in Oracle-assigned CVEs concentrated in long-lived products (E-Business Suite, Fusion Middleware, PeopleSoft). The report finds most fixes are newly published and internally credited, temporally aligns the surge with Oracle's April 2026 announcement of AI-assisted detection (while acknowledging a disclosure-policy change cannot be excluded), notes limited recorded exploitation (notably a PeopleSoft chain abused by ShinyHunters), and warns that sustained AI-driven discovery will materially increase patching workload and third-party risk.