Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
Brief
Oracle addresses 1235 CVEs in its third quarterly update of 2026 with 1449 patches, including 261 critical updates.
Key Takeaways
- The third Critical Patch Update (CPU) for 2026 contains fixes for 1235 unique CVEs in 1449 security updates, the largest CPU release.
- 261 issues (18% of all patches) were assigned a critical severity rating
- Oracle E-Business Suite received the highest number of patches at 410, accounting for 28.3% of all patches
Background
On July 21, Oracle released its Critical Patch Update (CPU) for July 2026 , the third quarterly update of the year. This CPU contains fixes for 1235 unique CVEs in 1449 security updates across 32 Oracle product families. Out of the 1449 security updates published this quarter, 18% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 52.