Oracle's June 2026 CPU: 245 Patches Across Communications, EBS, and Enterprise Manager

Oracle dropped its June 2026 Critical Patch Update this week, pushing 245 patches across a wide swath of its product portfolio. Communications, E-Business Suite, and Enterprise Manager all made the list. That's not a surprise — these are the products that tend to accumulate technical debt faster than the teams running them can apply patches.

In practice, the 'second monthly CPU' cadence is still relatively new territory for Oracle shops. The company shifted to monthly updates in 2025, and the operational reality is that most enterprises haven't fully adjusted their patching rhythms to match. Quarterly was already a stretch for a lot of teams. Monthly is genuinely hard.

The failure mode here is predictable. Platform engineers running Oracle EBS on EC2 or Exadata Cloud Service see the advisory, triage severity, and then hit the change management queue. By the time the CAB approves the window, you're three weeks out. Meanwhile the CVEs are public.

Enterprise Manager is a particularly uncomfortable one to leave unpatched. It's a management plane. Compromise it and you don't just own one Oracle instance — you potentially have lateral reach across everything it monitors. That's the kind of blast radius that makes a postmortem uncomfortable to write.

Oracle hasn't broken out per-CVE severity counts in the public summary at the time of writing, so the full CVSS distribution across all 245 fixes isn't immediately clear. What is clear is that Communications products are in scope, which matters for telcos and financial services firms running Oracle stack for billing and provisioning infrastructure.

One thing the post-mortem will say, if something goes wrong here: the patch was available.

Check the official Oracle advisory for affected product versions and patch availability before your next standup.