Oracle has released its August 2026 Critical Security Patch Update, addressing 943 new security patches across the affected Oracle product families.
The Fortra Intelligence and Research Experts (FIRE) team is reviewing the release and prioritizing coverage for vulnerabilities that combine remote reachability, low attack complexity, and high business impact.
At a Glance
| Metric | Value |
|---|---|
| New security patches | 943 |
| Unique CVEs in the risk matrices | 925 |
| Remotely exploitable without authentication | 451 unique CVEs |
| CVSS 9.0 or higher | 151 unique CVEs |
| Highest CVSS 3.1 base score | 10.0 |
Vulnerabilities to Watch
Oracle Internet Directory | OID LDAP Server | CVSS 10.0 | LDAP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 12.2.1.4.0, 14.1.2.1.0
This unauthenticated vulnerability in LDAP could allow an attacker to compromise Oracle Internet Directory (OID). Best practices dictate that OID should never be exposed to the internet, which limits the risk to internal pivots and insider threat. Given how LDAP is typically used, there is additional risk to other products should OID be compromised.
Oracle Hyperion Data Relationship Management | Access and security | CVSS 10.0 | TCP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 11.2.25.0.000
This unauthenticated TCP vulnerability could allow an attacker to compromise Oracle Hyperion Data Relationship Management (DRM). DRM should never be exposed to the Internet and can house critical business and financial information related to an organization. This makes it an appealing target for both insider threat and attackers who have already gained a foothold in the environment.
Oracle Hyperion Financial Management | Security | CVSS 10.0 | TLS
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 11.2.25.0.000
An unauthenticated TLS vulnerability could allow an attacker to compromise Oracle Hyperion Financial Management (HFM). Successful exploitation could lead to unauthorized creation, deletion, or modification of data and/or complete access to all data. As with the other vulnerabilities we’ve looked at today, the real risk here is both insider threat and attackers who have compromised the environment.
Helidon | Imperative Web Server | CVSS 9.9 | HTTP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 4.5.3
An unauthenticated HTTP vulnerability could allow an attacker to compromise the Helidon SE Web Server. Successful exploitation could lead to unauthorized creation, deletion, or modification of critical data. In this case, since web servers are typically exposed externally, there is an increased risk to the environment due to it being publicly available.
Product Family Breakdown
The following product families account for the largest patch volumes in this release. Review Oracle's full risk matrices and Patch Availability Documents for complete product and version details.
| Product family | Patches | Remote / no auth | Max CVSS |
|---|---|---|---|
| Oracle Fusion Middleware | 262 | 182 | 10.0 |
| Oracle Hyperion | 262 | 107 | 10.0 |
| Oracle E-Business Suite | 120 | 27 | 9.8 |
| Oracle Commerce | 66 | 47 | 9.8 |
| Oracle Siebel CRM | 50 | 21 | 9.9 |
| Oracle Supply Chain | 46 | 18 | 9.8 |
| Oracle Virtualization | 21 | 2 | 8.6 |
| Oracle Analytics | 16 | 3 | 9.9 |
| Oracle PeopleSoft | 15 | 7 | 9.8 |
| Oracle Communications | 13 | 9 | 9.8 |
Remediation Guidance
Organizations should inventory affected Oracle products and versions, review the applicable Patch Availability Documents in My Oracle Support, and prioritize internet-facing or otherwise exposed systems. Particular attention should be given to unauthenticated network vulnerabilities with low attack complexity and high confidentiality, integrity, or availability impacts.
Critical Security Patch Updates provide targeted high-priority fixes between quarterly cumulative CPUs. Organizations that have skipped releases should review previous CPU and CSPU advisories to determine the complete patching requirements for their environments.
Where immediate patching is not possible, reduce exposure to affected protocols, restrict unnecessary privileges, monitor for suspicious activity, and test temporary changes before production use. These measures do not replace applying the Critical Security Patch Update.
Sources
Oracle advisory: https://www.oracle.com/security-alerts/cspuaug2026.html
Text-form risk matrices: https://www.oracle.com/security-alerts/cspuaug2026verbose.html
Oracle security advisories index: https://www.oracle.com/security-alerts/
