Oracle August 2026 CSPU: 925 CVEs, 943 Patches — Prioritization, Detection, and Remediation Guide

On August 18, 2026, Oracle released its August 2026 Critical Security Patch Update (CSPU), and the numbers demand attention: 925 unique CVEs remediated across 943 security patches, with 154 issues — 16.3% of the entire release — rated critical. For context, this is only the fourth monthly CSPU since Oracle introduced the cadence in May 2026, slotting these high-severity focused releases between the traditional quarterly Critical Patch Updates (CPUs). The message from Oracle is unambiguous: the vulnerability volume in its product stack is too high, and exploitation velocity too fast, for a quarterly-only rhythm.

If your organization runs Oracle Fusion Middleware, WebLogic Server, E-Business Suite, Database, Java SE, MySQL, or any of the dozens of affected product families, this is not a "next maintenance window" event. Oracle's middleware and application-tier vulnerabilities have historically been among the fastest to be weaponized after patch release — exploit code frequently appears within days, and internet-facing WebLogic instances are scanned within hours. Your remediation clock started on August 18.

What Changed: The Monthly CSPU Model

Beginning in May 2026, Oracle split its patch delivery into two tracks:

• Quarterly CPUs — the traditional broad, cumulative releases (January, April, July, October).
• Monthly CSPUs — focused, high-severity releases in the intervening months, addressing a curated set of issues that Oracle judges too urgent to hold for the next CPU.

The August 2026 CSPU is significant not just for its size but for what it signals: Oracle is now treating a 925-CVE month as routine. Defenders who built their patch programs around a quarterly Oracle rhythm need to re-baseline immediately — your change advisory board, testing pipelines, and maintenance windows must now accommodate a monthly Oracle patch event on top of Microsoft's Patch Tuesday, which frequently lands in the same week.

Where the Risk Concentrates: Product Breakdown

The distribution of the 943 patches tells you exactly where attackers will focus:

Oracle Fusion Middleware's 262 patches — more than a quarter of the entire release — is the headline. Fusion Middleware encompasses WebLogic Server, HTTP Server, Coherence, Identity Management, and related components. This stack sits at the application delivery tier, frequently internet-facing or DMZ-adjacent, and it has a long, painful history of remotely exploitable deserialization and authentication bypass flaws that require no credentials and no user interaction.

Key implications for triage:

1. WebLogic Server and Coherence instances exposed to the internet are your P0. Historically, unauthenticated RCEs against WebLogic (particularly via the T3/IIOP protocols and the console) are exploited at scale within days of patch availability.
2. 154 critical-rated fixes means roughly one in six patches in this release addresses an issue Oracle considers critical — typically CVSS 9.x-class remote code execution, authentication bypass, or privilege escalation with low exploitation complexity.
3. Third-party component rollups matter. Fusion Middleware patches routinely bundle fixes for embedded open-source libraries (Jackson, Apache commons components, Spring artifacts). A single Fusion Middleware patch may close dozens of CVEs inherited from dependencies — which is exactly why the CVE count is so high.

Exploitation Status and Threat Context

As of this writing, the August 2026 CSPU is a coordinated vendor disclosure — Oracle releases patches simultaneously across all affected products, which is precisely when the exploit-development race begins. The practical reality every SOC should plan around:

• Patch-diffing is immediate. Oracle's predictable patch format lets researchers diff vulnerable versus patched classes within hours. WebLogic deserialization gadgets and console-access flaws are the first targets.
• Internet-facing Oracle middleware is scanned continuously. GreyNoise and honeypot telemetry consistently show scanning for new Oracle HTTP Server and WebLogic paths within 24–72 hours of a CPU/CSPU release.
• Unpatched Fusion Middleware is a ransomware initial-access vector. Multiple ransomware affiliates have historically used WebLogic RCEs for initial access, followed by web shell deployment, credential theft, and lateral movement into the internal network.

Treat every unpatched, network-reachable Oracle middleware instance as presumed targeted until remediated. Check CISA's Known Exploited Vulnerabilities (KEV) catalog daily over the coming weeks — Oracle flaws from large releases are frequent KEV additions once exploitation confirms, and KEV listing triggers binding remediation deadlines for federal agencies (and should trigger the same urgency for everyone else).

Detection & Response

Because this CSPU spans 925 CVEs, there is no single exploit signature to detect. The correct defensive posture is behavioral detection on post-exploitation activity against Oracle infrastructure — the consistent observable patterns that follow nearly every successful Oracle middleware compromise, regardless of which specific CVE was used as the door.

The highest-fidelity behaviors to hunt:

• WebLogic/Java application server processes spawning shells or interpreters (cmd.exe, powershell.exe, bash, sh) — the canonical post-RCE indicator for Oracle middleware exploitation.
• Web shells dropped under WebLogic domain directories (.jsp files written beneath servers/ or autodeploy/ paths).
• Outbound network connections from Java server processes to non-standard destinations — command-and-control following exploitation.
• HTTP requests probing WebLogic console and known vulnerable endpoints from external sources.

Sigma Rules

---
title: Oracle WebLogic or Java Server Process Spawning Shell
id: 8c2e4a17-3b91-4d56-ae27-9f1c6b8d2e40
status: experimental
description: Detects WebLogic Server or other Oracle Java application server processes spawning command shells or script interpreters, a strong post-exploitation indicator following remote code execution against Oracle Fusion Middleware.
references:
  - https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\startWebLogic.cmd'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate WebLogic administrative scripts invoking shells for startup or maintenance tasks
level: high
---
title: Web Shell Dropped in WebLogic Domain Directory
id: 4f7b2d93-1e58-4a62-bc39-8d2a5f7e1c96
status: experimental
description: Detects creation of JSP or executable script files inside Oracle WebLogic domain autodeploy or server directories, consistent with web shell deployment following exploitation of Fusion Middleware vulnerabilities.
references:
  - https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\autodeploy\'
      - '\servers\AdminServer\'
      - '\wlserver\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.cmd'
      - '.ps1'
      - '.exe'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate application deployments by development or DevOps teams — correlate with change tickets
level: high
---
title: Linux Java Server Process Spawning Suspicious Shell
id: 2a9c5e71-6d34-4b8f-ad42-7e3b9c1f5a08
status: experimental
description: Detects Java processes associated with Oracle middleware spawning interactive shells or download utilities on Linux, indicative of post-exploitation activity after remote code execution.
references:
  - https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Oracle Enterprise Manager agents and legitimate administration tooling
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query hunts across both endpoint process telemetry and network logs for the post-exploitation patterns that follow Oracle middleware compromise. Run it against your WebLogic, Fusion Middleware, and Oracle HTTP Server hosts.

// Hunt 1: Java/WebLogic server processes spawning shells or downloaders (Windows + Linux endpoints)
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","sh","bash","dash","nc","ncat","python","python3","perl"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("java","javaw")
   or InitiatingProcessCommandLine has_any ("weblogic","startWebLogic","wls","oracle")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;
// Hunt 2: Outbound connections from Java server processes to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("java","javaw")
| where RemoteIPType == "Public"
| where RemotePort !in (80, 443, 1521, 7001, 7002)
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 10), Ports = make_set(RemotePort, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by ConnectionCount desc;
// Hunt 3: Inbound probes against WebLogic console and common Oracle middleware paths (via firewall/WAF CEF ingestion)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/console/login","/console/css","/wls-wsat","/uddiexplorer","/_async","/bea_wls")
| where SourceIP !startswith "10." and SourceIP !startswith "192.168."
| summarize Requests = count(), TargetURLs = make_set(RequestURL, 10)
    by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| where Requests > 5
| order by Requests desc;

Velociraptor VQL — Post-Exploitation Artifact Hunt

Deploy this hunt across your Oracle middleware fleet to identify suspicious child processes of Java servers and recently dropped web-deployable files in WebLogic domain paths.

-- Hunt: Oracle middleware post-exploitation artifacts
-- Part 1: Java processes with suspicious child processes (live state)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|/bin/(ba)?sh|certutil|curl|wget|ncat|python)'
  AND Ppid IN (
      SELECT Pid FROM pslist() WHERE Name =~ '(?i)java|weblogic'
  )

-- Part 2: Recently created web-deployable files in WebLogic domain directories
-- Adjust the glob root to your Oracle home (e.g. /u01/oracle/user_projects/domains or C:\Oracle\Middleware)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    '/u01/oracle/**/autodeploy/**/*.jsp',
    '/u01/oracle/**/autodeploy/**/*.war',
    'C:/Oracle/**/autodeploy/**/*.jsp',
    'C:/Oracle/**/autodeploy/**/*.war'
])
WHERE Ctime > now() - 604800
ORDER BY Ctime DESC

Patch Verification Script

Use this Bash script on Linux/Unix Oracle homes to verify which patches are actually applied via OPatch — the authoritative source of truth, not your ticketing system. Run it per Oracle home and reconcile the output against the August 2026 CSPU patch list for your product and version.

#!/bin/bash
# oracle_cspu_verify.sh — Verify OPatch inventory for August 2026 CSPU reconciliation
# Usage: ./oracle_cspu_verify.sh /path/to/ORACLE_HOME

ORACLE_HOME="${1:-$ORACLE_HOME}"
if [ -z "$ORACLE_HOME" ] || [ ! -x "$ORACLE_HOME/OPatch/opatch" ]; then
  echo "[!] Valid ORACLE_HOME with OPatch not found. Pass it as an argument."; exit 1
fi

export ORACLE_HOME
export PATH="$ORACLE_HOME/OPatch:$PATH"

echo "=== OPatch version ==="
opatch version

echo "=== Applied patch inventory ($ORACLE_HOME) ==="
opatch lsinventory | tee /tmp/opatch_inventory_$(hostname)_$(date +%Y%m%d).txt

echo "=== Recently applied patches (last 45 days) ==="
opatch lsinventory -date | awk -v cutoff="$(date -d '45 days ago' +%Y%m%d 2>/dev/null || date -v-45d +%Y%m%d)" '$0 ~ /[0-9]{8}/ {print}'

echo "=== Reconciliation checklist ==="
echo "1. Compare interim patch IDs above against the August 2026 CSPU risk matrix for your product/version."
echo "2. Confirm no 'conflict' or 'rollback' entries in $ORACLE_HOME/cfgtoollogs/opatch/"
echo "3. For WebLogic: verify 'bsu'/'opatch apply' completed and NodeManager/AdminServer restarted cleanly."
grep -ri "conflict\|rollback\|failed" "$ORACLE_HOME/cfgtoollogs/opatch/" --include="*.log" -l 2>/dev/null | tail -5

For Windows-based Oracle homes, use the equivalent PowerShell:

# Verify Oracle patch inventory on Windows and flag failed OPatch operations
param([Parameter(Mandatory=$true)][string]$OracleHome)
$env:ORACLE_HOME = $OracleHome
$opatch = Join-Path $OracleHome "OPatch\opatch.bat"
if (-not (Test-Path $opatch)) { Write-Error "OPatch not found under $OracleHome"; exit 1 }

Write-Host "=== Applied patch inventory ==="
& $opatch lsinventory | Tee-Object -FilePath "C:\Temp\opatch_inventory_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd).txt"

Write-Host "=== Failed or rolled-back patch operations ==="
Get-ChildItem (Join-Path $OracleHome "cfgtoollogs\opatch") -Recurse -Filter *.log -ErrorAction SilentlyContinue |
  Select-String -Pattern "conflict|rollback|failed" -List |
  Select-Object Path, LineNumber | Format-Table -AutoSize

Write-Host "=== Action: reconcile patch IDs above against the August 2026 CSPU risk matrix for your product and version ==="

Remediation: Prioritized Action Plan

With 943 patches, you cannot patch everything at once — and you don't need to. Sequence ruthlessly by exposure and exploitability:

Phase 1 — Within 72 hours (internet-facing and DMZ):

1. Inventory every internet-reachable Oracle component: WebLogic Server, Oracle HTTP Server, Fusion Middleware, and any Oracle-backed application delivery tier. Use external attack surface scanning, not just internal CMDB data.
2. Apply the August 2026 CSPU to all internet-facing Fusion Middleware instances first. Fusion Middleware's 262 patches represent the highest concentration of remotely exploitable surface in this release.
3. If patching cannot complete within 72 hours, implement compensating controls: block external access to WebLogic administration ports (7001/7002), disable or restrict T3/IIOP protocol access at the perimeter (T3 is the historical vector for WebLogic deserialization RCEs — it should never be reachable from untrusted networks), and place instances behind a WAF with virtual patching rules.

Phase 2 — Within 2 weeks (internal high-value tiers): 4. Patch Oracle Database, E-Business Suite, and internal Fusion Middleware supporting crown-jewel business processes (ERP, financial reporting, identity management). 5. Patch Java SE broadly — Oracle Java runtimes embedded in third-party enterprise applications are frequently forgotten and carry the same CVEs.

Phase 3 — Within 30 days (everything else): 6. Complete the remaining product families per the CSPU risk matrix. Do not skip "medium" severity items in chained-exploitation-relevant components (identity management, SSO/OAM, database listeners).

Cross-cutting actions:

• Reconcile, don't assume. Use the OPatch verification scripts above to confirm patches actually applied and services restarted. Failed OPatch runs that nobody noticed are how organizations get breached through "patched" systems.
• Monitor CISA KEV daily. If any August 2026 CSPU CVE is added to KEV, federal civilian agencies face binding remediation deadlines under BOD 22-01 — treat the same deadline as your internal SLA regardless of sector.
• Update your patch calendar. The monthly CSPU cadence is permanent. Budget change windows and testing capacity accordingly — the September and October 2026 releases are already coming.
• Hunt retroactively. Run the Sigma, KQL, and VQL content above against the last 30 days of telemetry. If an attacker exploited a now-patched flaw before you remediated, patching alone does not evict them — look for web shells, persistence, and credential access that post-date your exposure window.

Official references:

• Oracle Critical Patch Updates and Security Alerts portal: https://www.oracle.com/security-alerts/
• August 2026 CSPU advisory and risk matrices (linked from the portal above)
• Tenable coverage: https://www.tenable.com/blog/oracle-august-2026-critical-security-patch-update-cspu-addresses-925-cves
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The Bottom Line

925 CVEs in a single mid-cycle release is not noise — it is the new normal for Oracle estates. The organizations that come through this release intact will be the ones that (1) know exactly where their Fusion Middleware and WebLogic exposure lives, (2) patched the internet-facing tier within days, and (3) hunted for post-exploitation behavior rather than trusting that a patch number in a spreadsheet equals protection. Patch fast, verify with OPatch, hunt for what got in before you closed the door.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub