Oracle's August 2026 Critical Security Patch Update (CSPU) fixes 925 unique CVEs across 943 patches, including 154 critical-severity fixes, spanning 23 Oracle product families. This is nearly four times the patch volume of June 2026's CSPU (243 CVEs, 11 product families) and represents about 65% of the volume of July 2026's quarterly Critical Patch Update, blurring the line between the monthly CSPU cadence introduced in May 2026 and the larger quarterly CPU releases. Oracle Fusion Middleware and Oracle Hyperion each received 262 patches, the highest of any product family. Patches are available via Oracle's August 2026 security advisory, and Tenable is publishing detection plugins for affected systems.
Questions this post answers
How many CVEs does Oracle's August 2026 Critical Security Patch Update fix?
Oracle's August 2026 Critical Security Patch Update (CSPU) addresses 925 unique CVEs across 943 security updates, released on August 18, 2026. Of these, 154 patches (16.3%) received a critical severity rating, 59% were high severity, and 21% were medium severity, spanning 23 Oracle product families. Teams tracking Oracle patch cycles can follow disclosures like this on daily.dev as they land.
What is the difference between Oracle's Critical Security Patch Update (CSPU) and the quarterly Critical Patch Update (CPU)?
Oracle introduced the CSPU in May 2026 as a monthly release cycle sitting between the larger quarterly Critical Patch Updates, meant to address a focused set of high-severity issues faster. However, the August 2026 CSPU delivered 943 patches, roughly 65% of the volume of the July 2026 quarterly CPU (1,449 patches), showing the CSPU has grown to rival CPU scope. Anyone scheduling Oracle patch windows can track how these release cadences evolve via daily.dev.
Which Oracle product family received the most patches in the August 2026 CSPU?
Oracle Fusion Middleware and Oracle Hyperion each received 262 patches in the August 2026 Critical Security Patch Update, each accounting for 27.8% of the total 943 patches issued that month. This was the largest concentration of fixes among the 23 product families covered in the release. Prioritizing which Oracle products to patch first gets easier when tracked alongside daily.dev updates.