# Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

DevFeed: [Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs](<https://devfeed.tech/articles/oracle-august-2026-critical-security-patch-update-addresses-925-cves-8269.md>)

Original publisher: [Read original article](<https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves>)

Author: Research Special Operations

Published: 2026-08-19T00:41:38Z

Content type: article

Language: en

Sources: [Tenable Blog](<https://devfeed.tech/sources/tenable-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [oracle](<https://devfeed.tech/tags/oracle.md>), [security](<https://devfeed.tech/tags/security.md>), [update](<https://devfeed.tech/tags/update.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Oracle's August 2026 Critical Security Patch Update addresses 925 unique CVEs through 943 security updates across 23 product families, including 154 critical patches. The release is substantially larger than the June CSPU and includes a high concentration of high-severity issues, with Oracle Fusion Middleware receiving the most patches.

## Source excerpt

Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. Key Takeaways The August 2026 Critical Security Patch Update (CSPU) contains fixes for 925 unique CVEs in 943 security updates 154 issues (16.3% of all patches) were assigned a critical severity rating Oracle Fusion Middleware received the highest number of patches at 262, accounting for 27.8% of all patches Background On August 18, Oracle released its Critical Security Patch Update (CSPU) for August 2026. Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. This CSPU contains fixes for 925 unique CVEs in 943 security updates across 23 Oracle product families, a nearly fourfold increase in patch volume compared to the June 2026 CSPU, which addressed 243 CVEs in 245 patches across 11 product families. To put that in context against the quarterly CPUs: the April 2026 CPU contained 481 patches across 241 CVEs, and the July 2026 CPU, the largest CPU release of 2026, contained 1,449 patches across 1,235 CVEs. August's CSPU at 943 patches sits well above the April CPU and represents roughly 65% of July's quarterly volume, a striking figure for what is nominally a targeted between-cycle release. The expansion to 23 product families (up from 11 in June) further blurs the line between CSPU and CPU in terms of scope. Out of the 943 security updates published, 16.3% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 59%, followed by medium severity patches at 21%. This month's update includes 154 critical patches across 151 CVEs. SeverityIssues PatchedCVEsCritical154151High556541Medium198198Low3535Total943925 Analysis This month's update saw the Oracle Fusion Middleware product family contain the highest number of patches at 262, acc