Oracle Critical Security Patch Update Advisory, September 2026: unauthenticated Fusion Middleware flaws lead 330 fixes

The release at a glance

The Oracle Critical Security Patch Update Advisory - September 2026 spans 330 CVEs across Oracle's products. The severity mix is 69 critical, 234 high, 24 medium and 3 low. Oracle E-Business Suite accounts for 159 of the CVEs, Oracle Fusion Middleware for 152, Oracle Database Server for 11, Oracle Java SE for 6, Oracle Enterprise Manager for 1 and Oracle Analytics for 1. No CVE in this release is recorded as exploited in the wild or listed in CISA KEV.

Among the highest-scoring issues, Oracle Access Manager, Oracle Platform Security for Java, Oracle WebLogic Server, Oracle Internet Directory and Oracle Forms each carry a CVSS 3.1 score of 10.0 and are reachable over the network without credentials. Several further items in Oracle Access Manager, WebCenter Portal, WebCenter Sites and Service Delivery Platform score 9.9 and require only low privileges.

What matters most

Oracle Access Manager has the sharpest items. CVE-2026-71133 is an unauthenticated HTTP issue in the Authentication Engine; Oracle rates it 10.0, with scope change and takeover of the product. CVE-2026-73945 is a lower-privilege issue, also in the Authentication Engine, scoring 9.9 and allowing takeover. Oracle Platform Security for Java CVE-2026-83020 is an unauthenticated HTTP issue in Centralized Thirdparty Jars, scored 10.0. Oracle WebLogic Server CVE-2026-83021 affects the Web Container, is unauthenticated over HTTP, scores 10.0 and allows takeover. Oracle Internet Directory CVE-2026-83059 is an unauthenticated LDAP issue in the OID LDAP Server, also scored 10.0. Oracle Forms CVE-2026-83099 is an unauthenticated HTTP issue in Forms Services, C/S, Charmode, also scored 10.0. Oracle WebCenter Portal CVE-2026-73948 is a low-privilege HTTP issue in Composer, scoring 9.9. Service Delivery Platform CVE-2026-82997 is a low-privilege T3/IIOP issue in Messaging Enabler, scoring 9.9. These matter first because they combine network access, low or no privileges, and Oracle's 'easily exploitable' assessment.

Patch in this order

1. Patch the unauthenticated network-facing Fusion Middleware components first: Oracle Access Manager CVE-2026-71133, Oracle Platform Security for Java CVE-2026-83020, Oracle WebLogic Server CVE-2026-83021, Oracle Internet Directory CVE-2026-83059 and Oracle Forms CVE-2026-83099. They score 10.0, require no credentials, and Oracle describes them as easily exploitable.
2. Patch the low-privileged Fusion Middleware items next: Oracle Access Manager CVE-2026-71163 and CVE-2026-73945, Oracle WebCenter Portal CVE-2026-73948, Service Delivery Platform CVE-2026-82997, CVE-2026-82998 and CVE-2026-82999, and Oracle WebCenter Sites CVE-2026-83031. These score 9.9 and require only low privileges.
3. Continue with the remaining Oracle Fusion Middleware and Oracle E-Business Suite updates, prioritising internet-facing E-Business Suite modules and any Fusion Middleware components reachable from untrusted networks.
4. Move to Oracle Database Server, Oracle Java SE, Oracle Enterprise Manager and Oracle Analytics according to your normal patch cycle.

Because no CVE in this release is in CISA KEV, there is no CISA due date to schedule around; the priority is exposure and Oracle's rating.

Beyond the patch

This release is defined by network-reachable, low-or-no-privilege Fusion Middleware flaws, which makes it a strong case for continuous exposure management rather than a quarterly scramble. Virtual CISO Services can help you keep internet-facing Oracle services visible and prioritised, and Implementation & Assessment Services can test the authentication and access-control boundaries in Access Manager, WebLogic Server and related components before the next CPU lands.