Tia N.List

Reported by 2 outlets

Oracle July 2026 CPU: 1,235 CVEs Patched — Largest Quarter Ever

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
4.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.22 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
tenable.comblog.qualys.com first seen 84d ago

Timeline

  1. original reporting

    Oracle July 2026 CPU: 1,235 CVEs Patched — Largest Quarter Ever

    tenable.com · 84d ago · July 22nd, 2026

    Oracle released its third quarterly Critical Patch Update for 2026 with 1,449 security updates addressing 1,235 unique CVEs — the largest CPU release. Key stats:

    • 261 critical patches (18% of total)

    • 763 high severity

    • 32 product families affected

    • Oracle E-Business Suite: 410 patches (28.3% — highest)

    • Oracle Fusion Middleware: 355 patches (24.5%)

    • 219 vulnerabilities in Fusion Middleware exploitable over network without authentication

    • Oracle Communications: 168 patches, 122 remote exploitable without auth

    • Oracle PeopleSoft: 84 patches, 45 remote exploitable without auth

    Action: Prioritize E-Business Suite and Fusion Middleware patches. Oracle Communications CVEs with remote no-auth vectors should also be addressed urgently.

  2. update from blog.qualys.com

    Oracle July 2026 CPU: 1,449 Security Updates, 1,235 CVEs — Largest Quarter

    blog.qualys.com · 83d ago · July 23rd, 2026

    Key statistics:

    • 86% (1,235) are for non-Oracle CVEs (open-source components in Oracle products)

    • Oracle E-Business Suite: 410 patches (28% of total) — highest

    • Oracle Fusion Middleware: 355 patches

    • Oracle Communications: 168 patches, 122 remotely exploitable without auth

    • Oracle GoldenGate: 27 new updates (max CVSS 9.1)

    • Oracle Database Server: 15 new updates (max CVSS 9.9)

    Action: Prioritize E-Business Suite and Communications product patches. Note that the vast majority are third-party component CVEs — these affect customers even if they don't directly use Oracle applications.

Source on GitHub