Oracle April 2026 CPU Release Intelligence
481 security patches across 28 Oracle product families — approximately 450 unique CVEs, with over 300 remotely exploitable without authentication. This is Oracle's last quarterly CPU before the monthly CSPU cadence begins on May 28, 2026.
April 2026 CPU at a Glance
Oracle's April 2026 Critical Patch Update is one of the largest quarterly security releases of the year — covering 28 Oracle product families with approximately 450 unique vulnerabilities patched. Over 300 of those vulnerabilities are remotely exploitable without authentication, meaning attackers can target unpatched systems directly over the network.
Top Patched Oracle Products — April 2026
Three Oracle product families account for the largest share of April 2026 CPU patches — prioritise these for impact analysis and regression scope.
All April 2026 CPU Product Advisories
Per-product-family security advisories from the April 2026 Critical Patch Update. Each card summarises the impact for that product family — affected components and recommended validations.
Network & Telecom Security Fixes
What changed: 139 security patches including 93 remotely exploitable vulnerabilities
Why it matters: Largest patch category in April CPU (Security Boulevard)
Banking & Financial Controls Security
What changed: 75 security patches across banking products
Why it matters: High exposure for financial institutions (Security Boulevard)
Middleware Security Hardening
What changed: 59 security fixes including WebLogic/OAM vulnerabilities
Why it matters: Identity and middleware layers widely exposed (Oracle)
Database Security Updates
What changed: 34 security patches across MySQL ecosystem
Why it matters: Databases are core integration backbone (Oracle)
ERP Security & Access Updates
What changed: 21 patches affecting PeopleSoft applications
Why it matters: ERP systems are high-value targets (Tenable®)
Legacy ERP Security Fixes
What changed: 18 security patches for EBS environments
Why it matters: Critical for on-prem ERP customers (Tenable®)
BI & Reporting Security
What changed: 15 patches for analytics stack
Why it matters: Reporting layers expose sensitive enterprise data (Tenable®)
Retail Platform Security
What changed: 15 remotely exploitable vulnerabilities
Why it matters: Retail systems often internet-facing (Tenable®)
CRM Security Updates
What changed: 14 patches affecting CRM workflows
Why it matters: CRM holds sensitive customer information (Tenable®)
Java Runtime Vulnerabilities
What changed: 11 patches including critical JVM vulnerabilities
Why it matters: Java underpins Oracle enterprise stack (Tenable®)
Data Replication Security
What changed: 10 security patches for replication components
Why it matters: Replication failures impact DR and integrations (Qualys)
Enterprise Monitoring Security
What changed: 9 security fixes for EM platform
Why it matters: Enterprise monitoring often privileged (Oracle)
Virtualization Security
What changed: 9 virtualization-related patches
Why it matters: Hypervisor compromise impacts all workloads (Tenable®)
Oracle DB Security Fixes
What changed: 8 database vulnerabilities fixed
Why it matters: Central system of record for ERP (oradba.ch)
Utility Sector Security
What changed: 7 security fixes for utility apps
Why it matters: Utilities are critical infrastructure (Tenable®)
Financial Planning Security
What changed: 6 Hyperion security fixes
Why it matters: Financial planning data highly sensitive (Tenable®)
Construction App Security
What changed: 4 security patches
Why it matters: Project systems manage large capital data (Tenable®)
Life Science Security
What changed: 4 security patches for life science apps
Why it matters: Compliance-heavy industry exposure (Tenable®)
SCM Security Fixes
What changed: 4 patches impacting supply chain systems
Why it matters: Supply chain outages impact operations (Tenable®)
Blockchain Security
What changed: 3 security fixes for blockchain services
Why it matters: Blockchain integrity is critical (Qualys)
Commerce Platform Security
What changed: 3 commerce-related vulnerabilities fixed
Why it matters: Public-facing commerce systems exposed (Tenable®)
JDE Security Updates
What changed: 3 security patches for JDE
Why it matters: Legacy ERP often poorly patched (Oracle)
RDF4J Integration Security
What changed: 2 security vulnerabilities fixed
Why it matters: Impacts semantic integration layers (Oracle)
Autonomous Infra Security
What changed: 2 security fixes for AHF
Why it matters: Health telemetry systems are privileged (Qualys)
REST Services Security
What changed: 2 REST Data Services vulnerabilities fixed
Why it matters: REST APIs expose ERP data externally (Tenable®)
Engineered Systems Security
What changed: 2 security patches for systems stack
Why it matters: Infrastructure compromise impacts enterprise stack (Tenable®)
In-Memory DB Security
What changed: 1 TimesTen vulnerability fixed
Why it matters: Used in high-speed transactional systems (Tenable®)
Hospitality Platform Security
What changed: 1 hospitality application vulnerability fixed
Why it matters: Hospitality systems often process payment data (Tenable®)
Affected Components Across April 2026 CPU
Deduplicated inventory of components impacted by the April 2026 CPU. Use these as your regression scope baseline.
Affected Pages
26Affected APIs
28Recommended Test Cases
36Oracle April 2026 CPU FAQs
Common questions about the April 2026 quarterly Critical Patch Update.
What is the Oracle April 2026 CPU?
How many vulnerabilities did the April 2026 CPU fix?
Which Oracle products had the most patches in April 2026?
How is the April 2026 CPU different from CSPUs?
What testing is needed after applying the April 2026 CPU?
Which April 2026 CPU patches are highest priority?
Validate the April 2026 CPU Across Your Oracle Stack
Tenant-specific April 2026 CPU impact analysis with auto-composed regression test packs — covering all 28 Oracle product families.