Oracle Releases August 2026 Critical Patch Update Advisory

Scheduled advisory includes 943 security updates across multiple Oracle product families

Threat ID:: CC-4833
Threat Severity:: Medium
Published:: 19 August 2026 1:22 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled advisory includes 943 security updates across multiple Oracle product families

Affected platforms

The following platforms are known to be affected:

Oracle E-Business Suite

Oracle Middleware

Oracle Communications

The following platforms are also known to be affected:

Multiple other Oracle product families. Please see Oracle's Critical Patch Update Advisory - August 2026 guide for full details.

Threat details

Introduction

Oracle has released the Critical Patch Update Advisory for August 2026 containing 943 security updates.

Of note is vulnerability CVE-2026-60782 (CVSSv3.1 score: 9.8) which, if exploited, could allow an unauthenticated remote attacker to takeover the Oracle Payments component of Oracle E-Business Suite.

Remediation advice

Affected organisations are encouraged to review Oracle's Critical Patch Update Advisory - August 2026 and apply the relevant updates as soon as possible.

Definitive source of threat updates

https://www.oracle.com/security-alerts/cspuaug2026.html

CVE Vulnerabilities

Status Published

CVE-2026-60782

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Last edited: 19 August 2026 1:22 pm