--- title: Oracle July 2026 Critical Patch Update: 1,449 patches... description: Oracle's July 2026 Critical Patch Update is the company's largest quarterly security release, delivering 1,449 patches covering 1,235 unique CVEs across 32... canonical: https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Oracle July 2026 Critical Patch Update: 1,449 patches across 32 product families | daily.dev og:description: Oracle's July 2026 Critical Patch Update is the company's largest quarterly security release, delivering 1,449 patches covering 1,235 unique CVEs across 32... og:url: https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6 og:image: https://api.daily.dev/og/posts/YDkB1Rru6.png og:image:alt: Oracle July 2026 Critical Patch Update: 1,449 patches across 32 product families og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Oracle July 2026 Critical Patch Update: 1,449 patches across 32 product families **[Collections](https://daily.dev/sources/collections)** · 2 min read · 2 upvotes · 0 comments ## Summary Oracle's July 2026 Critical Patch Update is the company's largest quarterly security release, delivering 1,449 patches covering 1,235 unique CVEs across 32 product families. Of these, 261 patches are rated critical and 763 are high severity. Oracle E-Business Suite leads with 410 patches, while Fusion Middleware has 355 patches including 219 remotely exploitable without authentication and ten with a perfect CVSS 10.0 score. Two notable Oracle Database Server flaws include CVE-2026-61211 (CVSS 9.9), which allows a low-privileged attacker to take full control of the RDBMS. Security teams are advised to use a tiered patching approach: internet-facing systems within 72 hours, internal systems within 10 days, and the rest before October's release. Oracle now runs both quarterly and monthly patch cadences simultaneously, adding operational complexity for enterprise teams. ## Content Oracle's July 2026 Critical Patch Update is its largest ever, delivering 1,449 patches covering 1,235 unique CVEs across 32 product families. Of those patches, 261 are rated critical severity, 763 high, and 358 medium. ## What got patched **Oracle Fusion Middleware** took the hardest hit with 355 vulnerabilities patched. Ten of those scored a perfect 10.0 CVSS — the maximum — and 219 are remotely exploitable without authentication. Affected components include Oracle WebLogic, Data Integrator, Access Manager, and Coherence. Dutch cybersecurity authorities specifically flagged two unauthenticated remote takeover flaws: CVE-2026-47056 in Oracle Data Integrator and CVE-2026-60217 in Oracle Coherence. **Oracle E-Business Suite** received the most patches overall at 410, accounting for about 28% of the total update. **Oracle Database Server** had two notable fixes. CVE-2026-61211 (CVSS 9.9) is a DBMS_CLOUD flaw that lets a low-privileged attacker take over the RDBMS entirely — affecting versions 19.3 through 19.31 and 23.4 through 23.26.2. CVE-2026-47040 affects Oracle Net Services. Two additional critical flaws were patched in Oracle's TimesTen in-memory database. Oracle Java SE, MySQL, and several other product families also received patches in this release. ## How to prioritize Security experts recommend a tiered response rather than trying to patch everything at once: - Internet-facing systems and any vulnerabilities already being reported in the wild: patch within 72 hours - Trusted core systems: within 10 days - Everything else: before the October quarterly release ## Why the volume keeps climbing Most of these vulnerabilities were found internally through AI-powered automated scanning rather than by external researchers. That's a meaningful shift. AI-assisted bug hunting is accelerating discovery rates across the industry — Microsoft has seen a similar spike in patch volume for the same reason. Oracle has also changed its release cadence to keep up. In May 2026 it introduced a monthly Critical Security Patch Update alongside the existing quarterly cycle, so teams are now managing two overlapping patch schedules. The operational complexity of enterprise patching is real, and this update makes clear it's not getting simpler anytime soon. ## Questions this post answers ### What is CVE-2026-61211 in Oracle Database Server and which versions are affected? CVE-2026-61211 is a critical DBMS_CLOUD vulnerability with a CVSS score of 9.9 that allows a low-privileged attacker to fully take over the RDBMS. It affects Oracle Database Server versions 19.3 through 19.31 and 23.4 through 23.26.2, and was patched in the July 2026 Critical Patch Update. _Teams tracking Oracle Database CVEs like this one can follow patch guidance on daily.dev._ ### How many vulnerabilities did Oracle patch in Oracle Fusion Middleware in the July 2026 Critical Patch Update? Oracle patched 355 vulnerabilities in Fusion Middleware, the hardest-hit product family in that update. Ten of those scored a perfect 10.0 CVSS, and 219 are remotely exploitable without authentication, affecting components including WebLogic, Data Integrator, Access Manager, and Coherence. Dutch cybersecurity authorities specifically flagged unauthenticated remote takeover flaws CVE-2026-47056 and CVE-2026-60217. _Anyone prioritizing WebLogic and Coherence patching can track advisories like this via daily.dev._ ### How should enterprises prioritize patching after a large Oracle Critical Patch Update? Security experts recommend a tiered response: patch internet-facing systems and any vulnerabilities already exploited in the wild within 72 hours, patch trusted core systems within 10 days, and patch everything else before the next quarterly release. This approach helps teams manage the operational load of large-scale updates like Oracle's 1,449-patch July 2026 release. _Teams juggling overlapping patch cycles can find prioritization guidance like this on daily.dev._ ## Similar posts on daily.dev - [Oracle July 2026 Critical Patch Update 1235 CVEs](https://daily.dev/posts/oracle-july-2026-critical-patch-update-1235-cves-irkciptx1) · Tenable Blog · 0 upvotes · 0 comments - [Oracle Critical Security Patch Update June 2026](https://daily.dev/posts/oracle-critical-security-patch-update-june-2026-oanshrtv4) · Tenable Blog · 0 upvotes · 0 comments - [Oracle Critical Security Patch Update August 2026](https://daily.dev/posts/oracle-critical-security-patch-update-august-2026-r6ygfhpmb) · Tenable Blog · 0 upvotes · 0 comments - [Oracle April 2026 Critical Patch Update Addresses 241 CVEs](https://daily.dev/posts/oracle-april-2026-critical-patch-update-addresses-241-cves-d4hmqt3bg) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Oracle July 2026 Critical Patch Update: 1,449 patches across 32 product families","url":"https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6"},"datePublished":"2026-07-22T18:16:20.018Z","dateModified":"2026-07-24T21:54:14.842Z","description":"Oracle's July 2026 Critical Patch Update is the company's largest quarterly security release, delivering 1,449 patches covering 1,235 unique CVEs across 32...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d1a2c626401f9f003d897c52da97455?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d1a2c626401f9f003d897c52da97455?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/oracle-july-2026-critical-patch-update-1-449-patches-across-32-product-families-ydkb1rru6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,oracle","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Oracle July 2026 Critical Patch Update: 1,449 patches across 32 product families"}]} ```