Patch Overload: Oracle Sets New Record With 1,449 Security Fixes

1,449 security fixes in a single day: The major software vendor Oracle has released more patches than ever before as part of its quarterly patch cycle.

For administrators running the affected products, that likely means setting aside significant time in the coming weeks to prioritize and deploy the updates. A look at the acknowledgments offers a possible explanation for the surge: External researchers are credited as reporters for just 64 of the vulnerabilities. This suggests that the vast majority of the flaws were discovered through the vendor’s own internal analysis. In April, the company had announced plans to increase its use of AI-powered tools for vulnerability discovery.

While the number may appear alarming at first glance, it primarily reflects the growing complexity of modern software ecosystems and an industry-wide shift toward more aggressive, automated vulnerability scanning. The bigger challenge is likely to be the pressure placed on IT teams, which must now distinguish critical fixes from lower-priority updates and deploy them without disrupting operations.

A similar pattern is emerging at Microsoft. The July Patch Tuesday release included 622 CVE entries, after June had already set a previous record with 206 CVEs. Microsoft’s Windows chief, Pavan Davuluri, had previously warned that the growing use of AI in bug discovery would lead to more security updates. He also pointed to automated patching mechanisms as a way to ease the burden on IT teams.

Monthly Mid-Cycle Updates Since May

To respond more quickly to the growing volume of vulnerabilities, the vendor expanded its patching model in May 2026. In addition to the existing quarterly cycle, Oracle has since introduced monthly Critical Security Patch Updates (CSPUs) designed to address the most urgent vulnerabilities. The company also recommends that affected customers make use of its support resources, including My Oracle Support, Technical Account Management, and Customer Success.

Ten Highest-Risk Vulnerabilities

Ten of the 1,449 patches address vulnerabilities with the maximum CVSS score of 10.0. All ten affect Oracle Fusion Middleware. Two of them have been classified as particularly critical by the Dutch National Cyber Security Centre (NCSC):

Neither vulnerability currently has a CWE classification. However, according to the NCSC-NL, both are considered easy to exploit. Depending on the vulnerability, attackers could execute malicious code, access data, or take complete control of affected systems. The lack of an authentication requirement further increases the risk of exploitation.

Two additional highly critical vulnerabilities affect the database server itself. CVE-2026-47040, which carries a CVSS score of 9.1, affects Oracle Net Service and allows unauthorized access to stored data. It can also repeatedly crash the affected service. The highest individual score in the entire update is assigned to CVE-2026-61211, a CVSS 9.9 vulnerability in the DBMS_CLOUD package. According to Badanoiu, even low-level privileges are sufficient to carry out remote code execution and take complete control of the database and other products that access it.

What Admins Should Do Now

Given the sheer volume of patches, organizations should establish a clear prioritization strategy based on severity. Particular attention should be paid to the ten vulnerabilities with the maximum CVSS score and the two critical Fusion Middleware flaws highlighted by the NCSC. Organizations running Oracle Data Integrator, Oracle Coherence, or affected database components should prioritize deploying the relevant security updates.

(lb)