Oracle has patched more than 1,400 vulnerabilities with its July 2026 Critical Patch Update (CPU), with a vast majority of the flaws likely identified by artificial intelligence.
According to Oracle, the latest quarterly CPU includes 1,449 security patches, addressing 1,434 unique CVEs across 334 products.
Vulnerabilities have been patched in products such as Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.
Security fixes are also available for Enterprise Manager, Financial Services Applications, Food and Beverage Applications, Fusion Middleware, Analytics, HealthCare Applications, Hospitality Applications, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Applications, Siebel CRM, Supply Chain, Systems, Utilities Applications, and Virtualization.
Roughly 600 of the patches are for vulnerabilities that can be exploited remotely without authentication. Hundreds of security holes have been assigned a critical severity rating.
The highest numbers of vulnerabilities were patched in E-Business Suite (410), Fusion Middleware (355), Communications (168), and PeopleSoft (84).
Considering that external researchers have only been credited for discovering a few dozen vulnerabilities, a vast majority of the newly patched flaws were found internally, likely with the aid of AI.
Oracle revealed earlier this year that it has access to top-tier AI systems, including Anthropic’s Claude Mythos and OpenAI’s most capable models, and is using them to speed up and sharpen vulnerability discovery and patching.
The company said it’s applying this AI-driven vulnerability work across its own software and services, Oracle Health, and the open source components it develops and relies on.
Organizations must install the latest patches as soon as possible, as threat actors often exploit Oracle product vulnerabilities in their attacks. Examples include the exploitation of a PeopleSoft zero-day and a recently patched EBS vulnerability.
Related: Estée Lauder Discloses Impact From Oracle EBS Zero-Day Hack
Related: Oracle’s Second Monthly Security Updates Deliver 245 Patches
