New Patching Model for Faster Response
Oracle has launched its first Critical Security Patch Update (CSPU), introducing a monthly security patching cycle designed to deliver urgent fixes more quickly than the traditional quarterly Critical Patch Updates (CPUs). The inaugural May 28, 2026 release addresses 35 newly identified vulnerabilities across multiple major product lines, including Oracle Database, Oracle REST Data Services (ORDS), Oracle Communications Unified Assurance, Oracle E-Business Suite, and Oracle Hospitality OPERA 5. Unlike the larger quarterly CPUs which bundle hundreds of fixes, this new CSPU model focuses on a smaller, targeted set of high-priority patches that Oracle has determined need accelerated remediation. Future CSPUs are planned for most third Tuesdays of each month, giving customers a faster channel to address serious security issues between the larger cumulative releases.
Impact Across Oracle Product Lines
The patches cover both Oracle’s proprietary code and popular third-party components embedded in its products, such as Apache Kafka, ActiveMQ, Tomcat, ZooKeeper, MySQL, PCRE2, libpng, and Apache HTTP Server. Oracle Database Server versions 23.4.0 through 23.26.2 receive three new security fixes for the Net Service component, all of which can be exploited remotely over TLS without authentication. Critically, these patches apply even to client-only installations without a full database server deployed, making patching essential for any environment where Oracle client libraries are exposed to untrusted networks. Oracle REST Data Services versions 24.2.0 to 26.1.0 are particularly affected, with 11 new security patches including several remotely exploitable without credentials. One vulnerability in the Backend-as-a-Service component carries a CVSS v3.1 base score of 10.0, indicating potential complete compromise of confidentiality, integrity, and availability on exposed ORDS endpoints. Oracle Communications Unified Assurance versions 6.1.1 through 7.0.0 receive eight new patches with four being exploitable remotely without authentication.
Source: Cyber Security News
