Oracle Patches 1,434 Flaws in One Go. AI Probably Found Most of Them.
Oracle's July 2026 quarterly security update is the largest in the company's history, covering hundreds of products used by hospitals, banks, retailers, and governments worldwide.
Key points
- Oracle released 1,449 security patches in its July 2026 quarterly update, covering 1,434 unique vulnerabilities across 334 products.
- Roughly 600 of the patched flaws could be exploited remotely by anyone on the internet, no password required.
- External researchers were credited for only a few dozen discoveries, suggesting Oracle's own AI tools found the vast majority.
- Oracle has confirmed it uses Anthropic's Claude Mythos and OpenAI's most capable models to hunt for software weaknesses.
- Criminals have actively attacked unpatched Oracle systems, including a zero-day in PeopleSoft and a flaw in Oracle E-Business Suite.
Oracle has issued its largest-ever quarterly security update. The July 2026 Critical Patch Update, the company's scheduled four-times-a-year bundle of security fixes, contains 1,449 patches addressing 1,434 distinct CVEs. A CVE, short for Common Vulnerabilities and Exposures, is the standard reference number assigned to each confirmed software flaw.
The volume is striking. Oracle's previous quarterly bundle delivered 245 patches. Products covered include Database Server, Java SE, MySQL, E-Business Suite, Fusion Middleware, PeopleSoft, Communications, and dozens more. E-Business Suite accounts for 410 of the fixes, Fusion Middleware for 355, and Communications for 168.
How did Oracle find so many bugs at once?
Almost certainly with AI. Outside researchers received credit for only a few dozen of the 1,434 CVEs. Oracle disclosed earlier this year that it has integrated top-tier models, including Anthropic's Claude Mythos and OpenAI's most capable systems, into its code-scanning process. Our 20 July story "The Real Mythos Problem Isn't New Bugs. It's How Long Yours Stay Open." examined exactly that pipeline, and what it means for defenders already drowning in unpatched findings. Oracle says it applies this AI-driven work across its own software, Oracle Health, and the open-source components it ships.
Finding software vulnerabilities has historically been slow, manual work. Machines don't get tired.
Should you worry about the flaws that were already being exploited?
Yes, and that concern predates this patch batch. Roughly 600 of the newly fixed flaws are remotely exploitable without authentication, meaning an attacker needs no username or password to try. Hundreds carry a critical severity rating.
Criminals haven't been waiting. Oracle PeopleSoft was hit by a zero-day, a flaw criminals were exploiting before Oracle knew it existed. A separate flaw in Oracle E-Business Suite was also attacked. On 16 July we reported that CISA gave federal agencies until Saturday to patch CVE-2026-46817, an E-Business Suite bug already under active attack, with Estée Lauder among the confirmed victims.
The practical read here is unglamorous but real. The patch volume matters less than the gap between release and installation on your network. If your employer, doctor, or bank runs Oracle software, the fixes are available now. If online portals you rely on behave oddly in coming weeks, report it.
