Oracle April 2026 Critical Patch Update released

Oracle's quarterly patch release fixes numerous vulnerabilities across its product portfolio, some allowing remote code execution, with no known exploitation in the wild.

Oracle issued its quarterly Critical Patch Update on April 21, 2026, addressing a large number of vulnerabilities spanning nearly its entire product line, including Oracle Database Server, E-Business Suite, WebLogic Server, Java SE, MySQL, PeopleSoft, Siebel, and numerous financial services, communications, retail, and utilities applications. The most severe of these flaws could allow an attacker to achieve remote code execution in the context of the logged-on user, with impact scope depending on the privileges of that account.

MS-ISAC notes that there are currently no reports of these vulnerabilities being exploited in the wild, indicating this is a routine but broad patch cycle rather than an active threat. Given the breadth of affected products—spanning government, financial services, telecommunications, healthcare-adjacent life sciences, retail, and energy/utilities sectors—organizations running Oracle software are advised to prioritize patching based on exposure and criticality, following standard vulnerability management practices such as automated patch management, least-privilege configurations, and exploit protection controls.

As with all Oracle Critical Patch Updates, the sheer volume of affected products and versions means impact assessment should be tailored to each organization's specific deployment footprint. No named threat actors, malware, or active campaigns are associated with this disclosure at this time.

Source reporting: https://www.cisecurity.org/advisory/oracle-quarterly-critical-patches-issued-april-21-2026_2026-041