Oracle Ships 673 Security Patches, Including Six Maximum-Severity Flaws

Oracle released its September 2026 Critical Security Patch Update on Tuesday, September 15, a bundle of 673 security patches spread across 17 product families. Independent analysis puts the count of distinct flaws at 672 CVEs, with 104 of them rated critical and more than 240 exploitable over a network without credentials.

Related reading: Check Point Patches Two 9.8-Severity VPN Flaws That Allow Unauthenticated Code Execution · SAP Patches a CVSS 10.0 Kernel Flaw That Requires No Credentials.

The number that will shape most prioritisation meetings is six: the vulnerabilities scored 10.0, the ceiling of the CVSS 3.1 scale. Five sit in Oracle Fusion Middleware and one in Oracle Hyperion Financial Management. Each is reachable by an unauthenticated attacker with network access, at low attack complexity, with no privileges and no user interaction required.

Six flaws at the maximum severity

The Fusion Middleware group covers the parts of Oracle's stack that most often face the internet: identity, directory services, application servers and forms rendering. They are Oracle Access Manager (CVE-2026-71133), Oracle Forms (CVE-2026-83099), Oracle Internet Directory (CVE-2026-83059), Oracle Platform Security for Java (CVE-2026-83020) and Oracle WebLogic Server (CVE-2026-83021). The sixth is Oracle Hyperion Financial Management (CVE-2026-87230).

Oracle's risk matrices read almost identically for the five middleware bugs. An attacker with network access reaches the vulnerable component, needs nothing else, and takes it over. Each carries a scope-change flag (S:C), meaning a successful attack can affect products beyond the component itself. That matters in middleware, where one compromised service can sit behind the authentication of many others.

Four are attacked over HTTP. Oracle Internet Directory is the exception: its flaw lives in the OID LDAP Server component and is triggered over LDAP, so defenders have to account for a directory port rather than a web endpoint when mapping exposure.

Affected versions vary by product, and that shapes who is actually exposed. The WebLogic flaw touches 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Access Manager, Internet Directory and Platform Security for Java cover 12.2.1.4.0 plus a 14.1.2.x release. Oracle Forms spans 12.2.1.19.0 and 14.1.2.0.0, and Hyperion Financial Management is a single 11.2.26.0.0 release. Organisations that have stayed on 12.2.1.4.0, a long-lived branch still common in on-premises estates, are affected by most of the middleware set.

The update also carries 13 Fusion Middleware flaws rated 9.9, a tenth below the maximum. They cluster in Access Manager, Internet Directory, WebCenter Portal, Service Delivery Platform and WebLogic Server.

Where the 673 patches land

The patch counts are not evenly spread. Oracle E-Business Suite received the largest batch at 159 patches, followed by Fusion Middleware at 153 and Hyperion at 102, according to Tenable. Siebel CRM (63), Analytics (50) and Communications (31) trail them.

Volume and exposure point in different directions. Of the 159 E-Business Suite fixes, 19 are remotely exploitable without authentication. Fusion Middleware, with slightly fewer patches, carries 78 unauthenticated network flaws. Hyperion adds 50. Tallying the per-family opening lines of Oracle's matrices gives 247 patches for flaws reachable without credentials, or 36.7% of the release, as analyst Marc-Frédéric Gomez calculated from the advisory. SecurityWeek reported the same concentration, putting it at over 240.

SecurityWeek also notes that the headline total understates the work. Oracle's 673 patches cover 672 unique CVEs in the published matrices, while the company says more than 130 additional CVEs are resolved through the same fixes, pushing the effective total past 800 vulnerabilities.

The 104 critical patches are a step up on the early months of the new cadence. Oracle's first monthly CSPU in May fixed 35 CVEs, with about a third rated critical. September is the largest bundle since the monthly program began.

Beyond the five biggest families, the update reaches further down the stack. Oracle Database Server received 11 patches, five of them remotely exploitable without authentication, including Oracle Net Services flaws an unauthenticated attacker can use to crash a listener. Oracle Java SE received three patches, all unauthenticated network flaws. Oracle Enterprise Manager received seven patches, five unauthenticated. The breadth is the point: a typical Oracle estate runs several of these families at once, so a complete response usually means coordinating database administrators, middleware administrators and application owners in the same window.

Why Fusion Middleware keeps returning

Fusion Middleware has anchored recent Oracle patch cycles. CIO.com reported that Oracle's July 2026 update addressed ten CVSS 10.0 vulnerabilities, the same pattern visible now. The reason is structural. WebLogic, Access Manager and the directory services are the front door for large enterprise applications, often deployed on-premises and often reachable from untrusted networks.

That mix of internet exposure and authentication logic makes the middleware tier a durable target. A flaw that defeats authentication can chain into every application trusting that tier, which is why the scope-change flag appears on all five of the September 10.0 bugs. The directory flaws deserve particular attention: Oracle Internet Directory and Access Manager are frequently the systems that decide who gets into everything else.

Maximum-severity ratings can also mislead. The 2025 Clop campaign that hit E-Business Suite customers relied on a 9.8 flaw, not a 10.0. Conversely, some of the most exploited enterprise flaws of recent years carried no public severity score at disclosure. The rating ranks severity; reachability and patch status decide whether an attacker can actually use it.

The move to monthly patching

Oracle no longer reserves its security fixes for four dates a year. Beginning May 28, 2026, the company added monthly Critical Security Patch Updates between its quarterly Critical Patch Updates, as it explained in May. CSPUs carry targeted high-severity fixes; CPUs remain cumulative and still run in January, April, July and October.

September is the fourth CSPU on the new schedule. Oracle's next dates are a CPU on October 20, 2026, a CSPU on November 17, and a CSPU on December 15. For teams that previously batched Oracle work into a quarterly maintenance window, the monthly cadence shortens the gap between a fix shipping and an internal freeze opening, but it also raises the frequency of change.

The E-Business Suite precedent

E-Business Suite's largest-batch status carries history. In 2025 the Clop extortion group exploited CVE-2025-61882 in the BI Publisher Integration and Concurrent Processing components, with Google's Threat Intelligence Group tracing exploitation to as early as August 9, 2025, weeks before a patch existed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 6, 2025.

That campaign did not depend on a maximum-severity score. It relied on an internet-facing enterprise application and unpatched systems. The September update includes three E-Business Suite flaws rated 9.8, CVE-2026-83327, CVE-2026-83452 and CVE-2026-83462, which is close enough to the ceiling to warrant the same urgency for anyone exposing EBS to the internet.

Exploitation status and caveats

Oracle makes no mention of any September vulnerability being exploited in the wild, and none of the six 10.0-rated CVEs appears on CISA's Known Exploited Vulnerabilities catalog as of September 19, 2026. The advisory repeats Oracle's standing warning that attackers regularly exploit flaws for which patches already exist and succeed when customers have not applied them.

Two caveats are worth keeping in view. Oracle tests and patches only supported releases, so organisations on versions outside Premier or Extended Support are not covered and should assume exposure. A maximum CVSS score is also a severity statement rather than evidence of exploitation; the practical risk depends on whether the affected component is reachable from an untrusted network.

Prioritising the work

Three questions sort the list quickly. First, is the component reachable from an untrusted network? That covers internet-facing WebLogic, Access Manager, the OID LDAP port and any Forms servlet. Second, does the component hold or broker identity? Access Manager, Internet Directory and Platform Security for Java sit underneath single sign-on for many applications, so a takeover there has a wide blast radius. Third, is the flaw reachable without credentials? Oracle flags 247 of the 673 patches that way, and those merit an emergency-change conversation rather than a routine ticket.

For the rest, the usual triage applies. Score, exposure and business criticality decide the order, and a 9.9 is not meaningfully safer than a 10.0 when it is unauthenticated and reachable over the network. Blocking a protocol or trimming privileges can reduce risk in the short term, as Oracle itself notes, but those measures can break applications and do not fix the underlying flaw.

What to watch

The immediate question is whether any of the September flaws turns up in exploitation reporting over the coming weeks, which would likely pull it onto the KEV catalog. The other is whether Fusion Middleware's run of 10.0 bugs continues into the October CPU, after July's batch of ten. Oracle's credit statement for this release lists external researchers including James Forshaw and teams such as Nebula Security, a reminder that these fixes begin as private reports rather than public discoveries.

For now the defensive work is unglamorous and available: identify which of the 17 product families you actually run, prioritise internet-facing middleware and directory services, and patch inside the monthly window rather than waiting for the next quarterly cycle.

Cover: Oracle's headquarters in Redwood City, California, by Davidlohr Bueso (CC BY 2.0) via Wikimedia Commons.