Oracle security patches hit 1,449 in quarterly update

Oracle security patches reached 1,449 in the company’s latest quarterly release, a record-sized batch that puts immediate work on administrators running Oracle products across enterprise environments. The number is notable less as a single indicator of code quality than as a signal that large software vendors are finding and shipping more fixes as automated vulnerability detection expands.

The fixes span Oracle’s broad product portfolio. Security experts speaking to The Register said the main concern is operational: IT teams now have to sort the most dangerous exposures from routine updates without disrupting systems that often sit close to core business processes.

Dray Agha, senior manager of security operations at Huntress, told The Register that the volume reflects the scale of modern software and increased use of automated scanning. His view was that enterprise defenders face the harder problem, deciding which flaws require urgent action and how to apply fixes without breaking production services.

Why did Oracle release so many security patches?

The batch appears to reflect two forces: Oracle’s large product base and the industry’s wider shift toward AI-assisted vulnerability discovery. Oracle announced in April that it was using AI in vulnerability detection, and Matei Badanoiu, lead security researcher at Pentest-Tools.com, told The Register that larger patch batches are likely to become routine as AI finds more bugs.

Microsoft has been seeing the same pressure in its own patch cycle. Its July Patch Tuesday covered 622 CVEs, up from 206 in June, which had already been a record for the company. Pavan Davuluri, Microsoft’s Windows vice president, wrote in a blog post that AI-assisted discovery would mean customers should expect more security updates in each release, and he pointed users toward automated patching tools.

Oracle is also changing how it ships critical fixes. Starting in May 2026, the company began adding monthly Critical Security Patch Updates, or CSPUs, alongside its established quarterly cycle. Oracle said the smaller monthly batches are intended to let customers apply high-priority fixes faster for on-premises systems, while cumulative quarterly updates continue.

Oracle’s Integrated Cyber Center has also directed customers to support resources including My Oracle Support, Technical Account Management and Customer Success for help handling patching workloads. The company did not present the 1,449 total as a single product failure, and the available details show the fixes are spread across many Oracle systems.

Which Oracle vulnerabilities are highest priority?

Ten of the 1,449 fixes carry the maximum CVSS severity score of 10.0, and all 10 affect Oracle Fusion Middleware. The Dutch National Cyber Security Centre singled out two of them, CVE-2026-47056 and CVE-2026-60217, as especially serious.

According to NCSC-NL, both flaws are easy to exploit and do not require authentication. CVE-2026-47056 can be exploited over HTTP to take control of Oracle Data Integrator, while CVE-2026-60217 can be used over TCP to compromise Oracle Coherence. The agency warned that, depending on the flaw, attackers could run malicious code, read sensitive data or fully take over systems, and said the lack of authentication raises exploitation risk.

Badanoiu also pointed to two Oracle Database Server vulnerabilities: CVE-2026-61211, rated 9.9, and CVE-2026-47040, rated 9.1. He told The Register that CVE-2026-47040 affects Oracle Net Service and can expose stored data while also creating a risk of repeated service crashes. He said CVE-2026-61211 affects the DBMS_CLOUD package and could allow a low-privilege attacker to achieve remote code execution and take over Oracle’s RDBMS, with possible effects on other products that rely on the database.

This story draws on original reporting from The Register.