Oracle Releases Largest Ever Security Update with 1,449 Patches

Oracle Corporation released its July 2026 Critical Patch Update, marking the largest security release in the company's history. The update provides 1,449 security patches addressing 1,434 distinct Common Vulnerabilities and Exposures (CVEs) across 334 products.

Fusion Middleware received 355 patches, including ten flaws that scored a perfect 10.0 on the Common Vulnerability Scoring System. A critical flaw in the Oracle Database Server's RDBMS component, identified as CVE-2026-61211, received a 9.9 score. Oracle warned that successful attacks using this vulnerability could result in a full takeover of the RDBMS, potentially impacting additional products.

Following the release, the Oracle Integrated Cyber Center urged users to transition immediately to a monthly security patching cycle to keep pace with the speed of vulnerability discovery. The company noted that it continues to receive reports of exploitation attempts targeting older vulnerabilities, often because organizations failed to apply updates promptly. To address these risks, Oracle has established a dual patching cadence, combining cumulative quarterly updates with a monthly Critical Security Patch Update program.