Oracle Issues April 2026 Critical Patch Update — 481 Fixes Across 28 Product Families

Oracle released its Critical Patch Update (CPU) for April 2026 on Tuesday, April 21, 2026 — the second quarterly security update of the year. The update delivers 481 security patches covering 241 unique CVEs across 28 Oracle product families, with 7.1% of patches rated at critical severity and scores reaching as high as 9.8 on the CVSS v3.1 scale.

Customers are strongly urged to apply these patches as soon as possible. Oracle Communications received the greatest share of fixes this cycle, followed by Oracle Financial Services Applications and Oracle Fusion Middleware.

It is important to note that 481 refers to the number of security patches issued, not the number of distinct vulnerabilities. The 241 unique CVEs are fewer because some vulnerabilities affect multiple products simultaneously, resulting in multiple patches for a single CVE.

Oracle Java SE: 12 New Patches, 8 Remotely Exploitable

This cycle’s Java SE update delivers 12 new security patches — one more than some pre-release summaries suggested. Of these, 8 vulnerabilities may be remotely exploited without authentication, meaning an attacker with network access requires no valid credentials to leverage them. The highest CVSS v3.1 Base Score for Java SE vulnerabilities is 7.5.

The following versions are identified as vulnerable and require immediate patching:

Users running any of the above versions should apply Oracle’s quarterly patch to obtain the corresponding fixed release. Oracle’s Java Management documentation confirms that the patched releases include Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1.

Oracle MySQL: 34 Patches, Critical Score of 9.8

Oracle MySQL received 34 new security patches this quarter, with 3 vulnerabilities remotely exploitable without authentication. Notably, the highest CVSS v3.1 Base Score for MySQL reaches 9.8 — a critical severity rating — significantly higher than many prior quarters.

The most severe MySQL vulnerability is CVE-2025-15467, found in the Enterprise Backup component of MySQL Enterprise Backup. Successful exploitation can result in remote code execution.

Affected MySQL product lines include:

Oracle Virtualization (VirtualBox)

Oracle’s Virtualization product family also received security patches in this cycle. Oracle VM VirtualBox users should apply the latest patch to address vulnerabilities, including those that are remotely exploitable without authentication, with CVSS scores up to 7.5.

Oracle recommends updating to the latest supported VirtualBox release. Users still running the VirtualBox 7.1 series should be aware that the 7.1 branch is approaching end-of-life and Oracle encourages migration to the VirtualBox 7.2 series for continued security support.

Oracle Communications: Highest Patch Volume at 139 Fixes

The Oracle Communications family dominated this quarter’s update with 139 security patches — accounting for 28.9% of all patches issued. Of these, 91 vulnerabilities can be exploited without authentication over a network. Several CVEs carry scores of 9.8, 9.6, and 9.1 and could lead to remote code execution if successfully exploited.

Oracle Financial Services Applications followed with 75 patches, and Oracle Fusion Middleware received 59 patches, including critical-severity CVEs with scores of 9.8 and 9.1.

Oracle Database Server: 8 New Patches

Oracle Database Server received 8 new security patches this quarter. Four of these vulnerabilities may be remotely exploited without authentication. The highest CVSS v3.1 Base Score is 7.5. Affected database versions span Oracle Database Server 19.3–19.30, 21.3–21.21, and 23.4.0–23.26.1.

Severity Breakdown

The full distribution of the 481 patches by severity is as follows:

Fact-Check: Circulating Summary Accuracy

A widely circulated summary of this CPU contained several inaccuracies. The table below documents key claims against verified information from Oracle’s official advisory and security researchers:

Recommended Actions

Oracle strongly recommends that all customers apply Critical Patch Update patches as soon as possible. Administrators should prioritize:

1. Oracle Communications — The largest attack surface this cycle, with 93 of 139 patches addressing remotely exploitable, unauthenticated vulnerabilities and CVSS scores up to 9.8.

2. Oracle MySQL Enterprise Backup — CVE-2025-15467 carries a CVSS score of 9.8 and enables remote code execution.

3. Oracle Java SE — 8 of 12 patched vulnerabilities are remotely exploitable. Update all affected JDK and JRE installations to the fixed versions (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, or 26.0.1).

4. Oracle Fusion Middleware and Financial Services — Both families contain critical vulnerabilities with code execution potential.

The next Oracle Critical Patch Update is scheduled for release on Tuesday, July 21, 2026.

The full advisory, risk matrices, and patch download links are available at Oracle’s official security alerts page: oracle.com/security-alerts/cpuapr2026.html