Oracle has released its September 2026 Critical Security Patch Update (CSPU), which includes 673 new security patches across a wide range of Oracle products and product families.

The update affects numerous enterprise solutions, including database platforms, middleware, enterprise applications, identity management solutions, and management tools.

Among the vulnerabilities addressed, six vulnerabilities have a CVSS score of 10.0, representing the highest severity level.

Key figures

• 673 new security patches
• 104 critical-severity patches
• 6 vulnerabilities with CVSS 10.0
• Multiple affected products and versions
• Some vulnerabilities can be exploited remotely and without authentication

CVSS 10.0 vulnerabilities

The following vulnerabilities are among the highest-severity issues addressed in the update:

These vulnerabilities affect different components and versions of the products listed above. In some cases, an unauthenticated remote attacker may exploit the vulnerability through network-accessible services, potentially resulting in unauthorized access or compromising the confidentiality and integrity of information.

CVE-2026-71133 – Oracle Access Manager

This vulnerability affects the authentication engine of Oracle Access Manager. It can be remotely exploited by an unauthenticated attacker through HTTP and may allow the affected product to be compromised.

CVE-2026-83099 – Oracle Forms

This vulnerability affects Forms Services, including the C/S and Charmode components. An unauthenticated remote attacker with HTTP access may exploit the vulnerability and compromise the affected product.

CVE-2026-83059 – Oracle Internet Directory

This vulnerability affects the LDAP server component of Oracle Internet Directory. It can be remotely exploited through LDAP by an unauthenticated attacker.

CVE-2026-83020 – Oracle Platform Security for Java

This vulnerability affects the Centralized Thirdparty Jars component. An unauthenticated remote attacker with HTTP access may compromise the product and potentially impact other products that depend on it.

CVE-2026-83021 – Oracle WebLogic Server

This vulnerability affects the Web Container component of Oracle WebLogic Server. It can be remotely exploited through HTTP by an unauthenticated attacker and may allow the server to be compromised.

CVE-2026-87230 – Oracle Hyperion Financial Management

This vulnerability affects the Security component of Oracle Hyperion Financial Management, version 11.2.26.0.000.

The vulnerability is easily exploitable by an unauthenticated attacker with network access through HTTP. Successful exploitation may allow unauthorized access to critical data, as well as unauthorized creation, modification, or deletion of information.

The vulnerability has a CVSS 3.1 score of 10.0.

Affected products

The Oracle security update affects a broad range of products and versions, including:

• Oracle Access Manager
• Oracle Forms
• Oracle Internet Directory
• Oracle Platform Security for Java
• Oracle WebLogic Server
• Oracle Database Server
• Oracle E-Business Suite
• Oracle Fusion Middleware
• Oracle Identity Manager
• Oracle WebCenter
• Oracle PeopleSoft
• Oracle Siebel
• Oracle Hyperion Financial Management
• Oracle Banking
• Oracle Communications
• Oracle Data Integrator
• Oracle VM VirtualBox, among others.

The specific impact depends on the product and version deployed. Organizations should therefore consult Oracle's official security advisory and risk matrices to determine whether their systems are affected.

Security recommendations

Organizations using affected Oracle products should consider the following actions:

1. Review the Oracle inventory and identify all deployed products and versions.
2. Identify affected versions, with particular attention to Internet-facing systems and vulnerabilities with a CVSS score of 10.0.
3. Apply the official Oracle security patches included in the September 2026 CSPU.
4. Verify that the patches have been successfully applied and confirm that vulnerable systems are no longer exposed.

Until the updates can be deployed, temporary risk-reduction measures may include restricting network access or removing unnecessary privileges. These measures should be considered temporary and do not replace the installation of the official security patches.

Why this update matters

The presence of CVSS 10.0 vulnerabilities, particularly those that can be exploited remotely without authentication, makes it important for organizations to review affected Oracle environments promptly.

Organizations running Oracle WebLogic Server, Oracle Access Manager, Oracle Forms, Oracle Internet Directory, Oracle Platform Security for Java, or Oracle Hyperion Financial Management should verify their installed versions and compare them against Oracle's official security advisory.

Official source

Oracle – Critical Security Patch Update Advisory, September 2026

https://www.oracle.com/security-alerts/cspusep2026.html

The official Oracle advisory should be consulted for the latest information regarding affected products, versions, CVEs, CVSS scores, and available security patches.