cyber.hendryadrian.com
Security News · securityweek.com

Oracle’s April 2026 CPU Delivers 481 Security Patches Across 28 Product Families

· Original article ↗

Summary

Oracle released 481 security patches across 28 product families in its April 2026 CPU. More than 300 address remotely exploitable flaws without authentication, and roughly three dozen fix critical-severity defects.

Key points

  • Oracle's April 2026 Critical Patch Update includes 481 patches and approximately 450 unique CVEs.
  • More than 300 patches address flaws remotely exploitable without authentication; roughly three dozen fix critical-severity defects.
  • Oracle Communications received 139 patches, while Financial Services Applications received 75 and Fusion Middleware 59.
  • Oracle says approximately 390 patched vulnerabilities were publicly disclosed within the past two years; five date to 2020 or 2021.
  • The CPU followed an emergency patch released one month earlier for CVE-2026-21992, a critical remote code execution flaw in Identity Manager and Web Services Manager.

Article Details

Event Type
Oracle released its April 2026 Critical Patch Update.
Impact
Oracle announced 481 security patches across 28 product families. The article estimates that approximately 450 unique CVEs are addressed; more than 300 patches address vulnerabilities remotely exploitable without authentication, and roughly three dozen fixes address critical-severity defects. Oracle Communications received the most patches (139), followed by Financial Services Applications (75) and Fusion Middleware (59).

CVE

CVE-2026-21992Oracle Corporation · Oracle Identity Manager; Oracle Corporation · Oracle Web Services ManagerOracle published the April 2026 CPU one month after it released an emergency patch for CVE-2026-21992, a critical-severity remote code execution flaw in Identity Manager and Web Services Manager.

Vendors

OracleOracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU).

Products

Analyticsexploitable by remote, unauthenticated attackers), PeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), Retail Applications (15 – 15), and Siebel CRM (14 – 13).E-Business Suite(34 fixes – 3 for issues exploitable by remote, unauthenticated attackers), PeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), Retail Applications (15 – 15), and Siebel CRM (14 – 13).Financial Services ApplicationsFinancial Services Applications was the second-most-impacted Oracle product, with 75 new security fixes, 59 of which addressed remote, unauthenticated bugs. Fusion Middleware followed closely, with 59 patches (46 flawsJava SESeveral products received close to a dozen patches each, including Java SE (11 – 7), GoldenGate (10 – 7), Enterprise Manager (9 – 8), Virtualization (9 – 1), and Database Server (8 – 4).MySQLOracle also released a significant number of patches for MySQL (34 fixes – 3 for issues exploitable by remote, unauthenticated attackers), PeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), RetailOracle CommunicationsOracle Communications received the largest number of security patches this month, at 139, including 93 for vulnerabilities that are remotely exploitable without authentication.Oracle Fusion MiddlewareOracle product, with 75 new security fixes, 59 of which addressed remote, unauthenticated bugs. Fusion Middleware followed closely, with 59 patches (46 flaws exploitable remotely, without authentication).PeopleSoftnumber of patches for MySQL (34 fixes – 3 for issues exploitable by remote, unauthenticated attackers), PeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), Retail Applications (15 – 15), and Siebel CRMRetail Applicationsunauthenticated attackers), PeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), Retail Applications (15 – 15), and Siebel CRM (14 – 13).Siebel CRMPeopleSoft (21 – 7), E-Business Suite (18 – 8), Analytics (15 – 11), Retail Applications (15 – 15), and Siebel CRM (14 – 13).

Related Articles