Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

August 19, 2026 · Tenable Blog · Severity: CRITICAL

Oracle released its August 2026 Critical Security Patch Update (CSPU) addressing 925 unique CVEs across 943 security updates, including 154 critical-severity patches. This represents a nearly fourfold increase in patch volume compared to the June 2026 CSPU, which addressed 243 CVEs. Oracle Fusion Middleware received the highest number of patches at 262, accounting for 27. 8% of all patches, with fixes spread across 23 Oracle product families. The August CSPU sits well above the April 2026 CPU in patch volume and represents roughly 65% of the July 2026 quarterly CPU volume, blurring the line between targeted monthly releases and larger quarterly updates. High-severity patches accounted for 59% of the total, followed by medium severity at 21% and low severity at 4%. 📌 **Analyst Note:** This release marks a significant escalation in Oracle's patching cadence, with the CSPU program expanding far beyond its original intent of focused between-cycle fixes. Security teams should prioritize the 154 critical patches, particularly those affecting Oracle Fusion Middleware, which received the highest concentration of updates.