Oracle Critical Patch Update: 245 High-Priority Security Fixes Demand Immediate Attention

Oracle's Largest Focused Patch Release Targets High-Risk Enterprise Systems

Oracle has released a Critical Security Patch Update (CSPU) containing 245 newly announced fixes for supported on-premises software — and security experts are urging enterprise IT teams not to treat this as routine maintenance. Unlike Oracle's traditional quarterly patch cycle, this release is part of a newer, more agile patching approach designed to address critical vulnerabilities faster, responding to an industry-wide shift toward closing security gaps before threat actors can exploit them. The Oracle critical security patches span a wide range of products, including Oracle Enterprise Manager, JD Edwards, Fusion Middleware, MySQL, PeopleSoft, and more, making the scope of this update unusually broad.

Oracle framed the release as a targeted, high-priority effort: "Oracle conducts an analysis of each security vulnerability addressed by a Critical Security Patch Update. Oracle provides this information so that customers may conduct their own risk analysis based on the particulars of their product usage." The company's intent is to keep these updates smaller and more focused than the traditional quarterly batch, reducing disruption during deployment. But for IT teams managing complex, customised enterprise environments, even a "focused" update of 245 patches carries significant operational weight — and the risk calculus behind several of these vulnerabilities demands immediate escalation.

Which Oracle Vulnerabilities Pose the Greatest Risk Right Now?

Not all 245 patches carry the same urgency, and security professionals are drawing sharp distinctions about where organisations should focus first. The most alarming disclosure in this batch is CVE-2026-35273 — a critical remote code execution vulnerability in Oracle PeopleSoft PeopleTools. Oracle confirmed that this flaw was already being actively exploited in the wild before the patch was even shipped, which places it in a category that requires emergency response rather than scheduled maintenance.

Flavio Villanustre, CISO for LexisNexis Risk Solutions, highlighted the severity: "The PeopleSoft patch for CVE-2026-35273 stands out because it addresses a critical remote code execution vulnerability in Oracle PeopleSoft, which is widely exploited in the wild. This patch was released as an out-of-band Security Alert and requires immediate remediation."

Chris Doyle, head of security and compliance at JupiterOne, reinforced this assessment: "The one carrying the most immediate urgency is CVE-2026-35273 in PeopleSoft PeopleTools, which Oracle confirmed was already being actively exploited before this patch even shipped, and PeopleSoft runs the HR, finance, and student systems that ransomware operators specifically target. These are deeply coupled systems that require coordinated upgrades across multiple layers with regression testing at each step. There's often no easy compensating control to buy time — you just have to patch your way through it."

Beyond PeopleSoft, Doyle flagged the CVSS 10.0 — the maximum possible severity score — vulnerabilities in Oracle Coherence and WebLogic Server as particularly dangerous. Both are remotely exploitable with no authentication required. "Coherence sits underneath a lot of enterprise application stacks, so compromising it isn't just one system — it's a pivot point into everything that depends on it," he noted. "WebLogic has been a ransomware and crypto mining target for years and unauthenticated console access is exactly the foothold those campaigns look for." WebLogic's track record with attackers is well-documented: prior flaws in the product already appear on the CISA Known Exploited Vulnerabilities catalogue, a government-maintained list of actively weaponised security issues.

Fusion Middleware's 106-Patch Problem Is a Control-Plane Crisis, Not Just a Patching Backlog

The single largest concentration of vulnerabilities in this update sits within Oracle Fusion Middleware, which received 106 patches — more than 43% of the entire batch. Of those, 53 are reachable remotely without any authentication. Sanchit Vir Gogia, chief analyst at Greyhound Research, argued that this framing matters enormously for how organisations should respond.

The distinction is important: a "patch hygiene" problem is one of operational process — applying known fixes in a timely manner. A "control-plane problem" means the fundamental layer that other systems trust and depend upon is compromised. Components like WebLogic Server, Oracle Coherence, Oracle Unified Directory, and WebCenter all appear in this batch. Gogia noted that Oracle Unified Directory can be taken over without authentication via LDAP, and that WebCenter sits at the public edge of enterprise environments. Several of these flaws are scope-changing, meaning a single compromised component can cascade into breaches of entirely separate products.

Adding complexity to the situation, a number of Fusion Middleware products are approaching end-of-support from Oracle by the end of the year. For organisations still running these environments, the challenge is compounded: they must patch a heavily targeted product while simultaneously planning and executing a migration they cannot defer. Doyle captured the risk window precisely: "These environments are heavily customised, which makes patching slow, and that gap between 'patch available' and 'patch applied' is exactly when attackers move."

Villanustre offered some measured reassurance on the end-of-support timeline: "Oracle offers extended support for Fusion Middleware until December 2027 for those with the appetite to pay more money in lieu of upgrading, so it will still be supported for 18 more months, starting now." For organisations that cannot complete a migration before the standard support deadline, the paid extended support pathway at least ensures continued access to patches — but it is not a long-term strategy.

Breaking Down the Most Critical Components in This Patch Cycle

Why Waiting for Confirmed Exploitation Before Patching Is the Most Dangerous Strategy

One of the more counterintuitive points raised by analysts in response to this update is the false comfort that comes from vulnerabilities not yet confirmed as exploited. Enterprise security teams sometimes use absence of known exploitation as a reason to delay patching — particularly in environments where testing and deployment cycles are long and disruption risks are real. Gogia offered a sharp rebuttal to this reasoning.

"The absence of confirmed exploitation elsewhere is no comfort. Once an advisory is published, attackers read it, reverse the fix, scan the exposed enterprise environments and race the customers still waiting on a maintenance window," he said. "WebLogic has not suddenly become dangerous. It has been a standing target for years, and one of its earlier flaws already sits on the Known Exploited Vulnerabilities government catalogue. Waiting for public proof of exploitation is the most expensive patch strategy on the menu. By the time the proof arrives, the quiet work is generally done."

This dynamic is well-documented in security research. According to analysis tracked by CISA and industry researchers, the average time between public disclosure of a critical vulnerability and first active exploitation is shrinking — in some cases falling to hours rather than days. For vulnerabilities in widely-deployed enterprise platforms like

Originally reported by CSO Online. Summarised and curated by European Purpose.