Oracle's monthly patch drop hit 925 CVEs in August, four times June's volume

Oracle released its August 2026 Critical Security Patch Update on August 18 with fixes for 925 unique CVEs in 943 security updates across 23 product families ^[1][2]. That is a nearly fourfold jump on the June CSPU, which addressed 243 CVEs in 245 patches across 11 families ^[3][4], and it means the "between-cycle" release Oracle started shipping in May is now sized like a quarterly one.

The positioning is worth stating plainly. Oracle introduced CSPUs in May 2026 as a monthly cycle sitting between the larger quarterly Critical Patch Updates, addressing a focused set of high-severity issues on a faster cadence, per Tenable's write-up ^[5]. August does not read as focused. Its 943 patches are about 1.96 times the April 2026 CPU, which carried 481 patches across 241 CVEs ^[6][7], and roughly 65% of the July 2026 CPU, the largest quarterly release of 2026 at 1,449 patches across 1,235 CVEs ^[8][9]. Measured in unique CVEs rather than patches, August covered about 75% of what the year's biggest CPU covered ^[10]. The product family count doubled, from 11 in June to 23 ^[2][4], which Tenable notes further blurs the line between the two release types ^[5].

Severity does not offer much relief. There are 154 critical patches, 16.3% of the total, spanning 151 CVEs ^[11][12]. High severity accounts for 59% of patches and medium 21% ^[13]. That puts roughly 710 of the 943 patches at critical or high ^[14], of which about 556 are high ^[15].

One structural detail helps triage: the volume is concentrated. Tenable's breakdown places Oracle Fusion Middleware at 262 patches, 27.8% of the total, and lists Oracle Hyperion at the same 262 patches and 27.8% ^[16][17]. Together those two families account for 524 patches, 55.6% of the release ^[18]. The source describes Fusion Middleware as the highest while assigning both families identical figures, so treat the ordering between them as unresolved rather than reported.

Another detail changes how the headline number should be read. August's ratio is 1.02 patches per CVE ^[19], where April's CPU ran 2.00 patches per CVE ^[20]. Large CPU patch counts have historically been inflated by multiple fixes per CVE across versions; August's near one-to-one ratio means the CVE list itself is what expanded, not the packaging. For teams whose SLA clocks start on CVE identifiers rather than on patch artifacts, that is the more expensive shape.

The immediate planning consequence: July and August together delivered 2,392 patches in two consecutive months ^[21]. A patch programme built on four annual Oracle surges, with monthly CSPUs treated as small top-ups, is now mis-sized. Change windows, regression test capacity and Fusion Middleware and Hyperion owners need to be booked monthly at something closer to CPU scale.

Watch whether the September CSPU lands nearer August's 943 or June's 245, since one month is not yet a cadence ^[2][4]. Watch the product family count, because 23 families implies a wider set of application owners in each window than 11 did ^[2][4]. Watch whether the next quarterly CPU shrinks as monthly releases absorb more of the load, or whether both stay large. And in Tenable's per-family table, the column that counts vulnerabilities exploitable over a network without authentication ^[22] is the one that should set the order of work.