Half of Oracle's Fusion Middleware patches fix flaws reachable without a login
Oracle's fifth monthly Critical Security Patch Update since May concentrates its unauthenticated remote flaws in Fusion Middleware and Hyperion, while the largest single batch of patches went to E-Business Suite.
The Watch · Security desk
What happened
- Oracle shipped its September 2026 Critical Security Patch Update on September 15, with 673 patches covering 672 unique CVEs across 17 product families.
- More than 240 of the newly patched flaws can be exploited over a network without authentication, and more than 100 are rated critical severity.
- E-Business Suite took the largest batch at 159 patches, followed by Fusion Middleware at 153 and Hyperion at 102, with Siebel CRM and Analytics next.
Why it matters
- Who's exposed exposure An attacker with network reach to a Fusion Middleware or Hyperion host is inside the threat model for about half of each family's fixes, before any credential theft is needed.
- What it limits constraint Because 61.5 percent of the patches land in three families, the work cannot be spread evenly across teams: the same middleware and applications groups absorb most of the release.
- Who has to decide decision Triage by batch size puts E-Business Suite first, where 12 percent of fixes are unauthenticated; triage by reachability puts Fusion Middleware first, where 51 percent are.
- What it sets up precedent On a monthly cadence, any family that needs more than 30 days of testing and restart windows will be holding two open batches at once.
Next story · Leadership · Oct 1
Monthly vulnerability disclosures more than double since start of 2026, GTIG findsConfirmed2 publishers
Reachability separates the families. Fusion Middleware's patches include 78 flaws exploitable over a network with no credentials, about half of that family's total [9][21]. Hyperion has 50, close to half again [11][21]. E-Business Suite, which took the largest batch, has 19, or 12 percent [7][21].
Those three families hold 414 of the 673 patches [18] and 147 of the unauthenticated remote flaws, roughly three-fifths of that total [17][4]. I would sequence by the second number. The 128 no-credential flaws in Fusion Middleware and Hyperion [19] are the ones an attacker can try from a network position, with no phishing step first.
The 800-plus total comes from bundling. Oracle counts 672 unique CVEs in the advisory's risk matrices and notes more than 130 further CVEs fixed by patches issued for other flaws, so at least 802 CVEs are in scope [3][20]. Communications received 31 patches, and half of them resolve more than 125 additional CVEs [13]. Nearly all of the extra CVE count sits in that one family [23]. Siebel CRM took 63 patches and Analytics 50 [12].
Oracle moved the CSPU to a monthly cycle in May 2026, sitting between the larger quarterly Critical Patch Updates and covering a focused set of high-severity issues [16]. September is the fifth of those monthly releases [22].
Oracle makes no mention of any of these vulnerabilities being exploited in the wild, and warns customers that threat actors regularly exploit flaws in its products [14]. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay," Oracle said [15].
Tenable's breakdown puts critical patches at 104, or 15.5 percent of the release, with high-severity patches at 74.7 percent [6][10]. The two bands together account for 90.2 percent of the 673 updates [24].
What to watch
- Any of the 672 CVEs landing in CISA's Known Exploited Vulnerabilities catalog.
- Public proof-of-concept code for one of the 78 unauthenticated Fusion Middleware flaws.
- Whether October's CSPU adds another triple-digit batch to E-Business Suite or Fusion Middleware.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Oracle released its Critical Security Patch Update (CSPU) for September 2026 on September 15.
- [2]
The September 2026 CSPU contains fixes for 672 unique CVEs in 673 security updates across 17 Oracle product families.
- [3]
There are 672 unique CVEs in the 17 risk matrices of the September 2026 CSPU advisory, and Oracle also notes that more than 130 additional CVEs have been resolved with the patches for other flaws, so the updates appear to resolve more than 800 vulnerabilities.
- [4]
More than 240 of the newly addressed security defects are remotely exploitable without authentication.
- [5]
More than 100 of the newly addressed security defects are critical-severity flaws.
- [6]
104 issues, or 15.5 percent of all patches, were assigned a critical severity rating.
- [7]
Oracle E-Business Suite received 159 security patches, the largest batch of the CSPU, and 19 of those vulnerabilities can be exploited remotely without authentication.
- [8]
E-Business Suite's 159 patches accounted for 23.6 percent of all patches in the release.
- [9]
Fusion Middleware received 153 patches, including fixes for 78 unauthenticated, remotely exploitable flaws.
- [10]
High-severity patches accounted for the bulk of the release at 74.7 percent.
- [11]
Hyperion was third with 102 patches, 50 of them for flaws remotely exploitable without authentication.
- [12]
Oracle also issued patches for Siebel CRM (63), Analytics (50), Communications (31), Commerce (27), Supply Chain (19), Virtualization (19) and PeopleSoft (16).
- [13]
Half of the 31 patches in the Communications update resolve more than 125 additional CVEs.
- [14]
Oracle makes no mention of any of these vulnerabilities being exploited in the wild, but warns users that threat actors are regularly exploiting flaws in its products and urges customers to apply the updates as soon as possible.
- [15]
"In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
- [16]
Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates, addressing a focused set of high-severity issues on a faster cadence.
- [17]
E-Business Suite, Fusion Middleware and Hyperion together account for 147 of the more than 240 unauthenticated, remotely exploitable flaws, about 61 percent.
- [18]
The three largest product families account for 414 of the 673 patches, or 61.5 percent of the release.
- [19]
Fusion Middleware and Hyperion together carry 128 unauthenticated, remotely exploitable flaws.
- [20]
The unique CVEs in the risk matrices plus the additional CVEs Oracle notes give at least 802 CVEs in scope.
- [21]
Unauthenticated remote flaws are 51 percent of the Fusion Middleware patches, 49 percent of the Hyperion patches and 12 percent of the E-Business Suite patches.
- [22]
September 2026 is the fifth monthly CSPU since the cadence began in May 2026.
- [23]
More than 125 of the more than 130 additional CVEs sit in the Communications family, about 96 percent.
- [24]
Critical and high-severity patches together account for 90.2 percent of the 673 updates.
Sources
2 independent publishers whose own reporting we read for this story.
- securityweek.comOracle Patches 800+ Vulnerabilities in September 2026 Security Update
1 article · September 16, 2026
- tenable.comOracle September 2026 Critical Security Patch Update addresses 672 CVEs
1 article · September 15, 2026
Topics and entities
Entities
- SecurityWeek
- Oracle
- Oracle Fusion Middleware
- Tenable
- CVE
- Oracle Critical Security Patch Update (CSPU)
- Oracle E-Business Suite