Oracle Ships 943 Patches in August 2026 Update, More Than 460 Exploitable Without Credentials

Oracle released 943 new security patches on August 18, 2026 as its August 2026 Critical Security Patch Update (CSPU), the third installment of the monthly CSPU cadence it introduced in May 2026 to run alongside its older quarterly Critical Patch Update. The release spans 23 product families, and Oracle's per-product risk matrices flag more than 460 of the patched flaws as remotely exploitable without authentication, meaning an attacker needs no credentials at all.

Two smaller product families are worth a closer look this month because their names suggest a possible clinical tie. Autonomous Health Framework received 7 patches, the highest a CVSS 8.8 flaw, CVE-2026-70715, in its Trace File Analyzer component, reachable over TLS from an adjacent network with no authentication or user interaction required. Application Testing Suite also received 7 patches, topped by a CVSS 9.1 flaw, CVE-2026-70862, in its Test Manager for Web Apps component, reachable over plain HTTP with no authentication required, affecting version 13.3.0.1. Both sets of figures come from Oracle's own risk matrix tables for this release.

The high number of patches this cycle is likely tied to Oracle's own increased use of AI to fish vulnerabilities faster, and this release still runs behind July's quarterly Critical Patch Update, which shipped 1,449 patches addressing more than 1,400 CVEs. Oracle's advisory repeats a recurring warning as the company continues to see attempted exploitation of vulnerabilities it has already patched, almost always because a customer had not yet applied the fix.

What does this mean for MedTech

Autonomous Health Framework is Oracle Database's own internal diagnostics toolkit, bundling components like Trace File Analyzer and Cluster Health Analyzer that watch database health, not patient health, and nothing among this month's 23 patched product families is related to Oracle Health platform. Hence, no regulated medical device or clinical system is named anywhere in this release. That said, dismissing this update as irrelevant to MedTech would be a mistake for a different reason. The two largest patch batches, Fusion Middleware at 262 patches and Hyperion at another 262, sit squarely inside the kind of general enterprise infrastructure that regulated manufacturers and healthcare providers run underneath the operations they do watch closely such as an ERP and supply chain systems that track device inventory and quality records, financial and revenue-cycle systems that touch patient billing data, and Fusion Middleware instances that quietly integrate a dozen other applications together. A hospital system or device manufacturer running Oracle Database or Fusion Middleware behind a system that stores protected health information or manufacturing quality data is exposed to the same 460-plus remotely exploitable bugs as any other Oracle customer this month. HIPAA's Security Rule risk analysis requirement does not distinguish between a vulnerability in a labeled clinical product and one in the database engine underneath it, both have to be identified and addressed as part of an organization's ongoing risk assessment. The practical takeaway here is to treat a large horizontal vendor release like this one as an inventory exercise first, find out which of the 23 patched product families you actually run, rather than assuming the absence of a clinical product name means the release does not apply to you.

Quick ToDos

• First, inventory which of the 23 patched product families are actually running in your environment before treating this as routine. Fusion Middleware and Hyperion carry the largest share of remote-without-authentication bugs this cycle at 182 and 107 respectively.

• If Application Testing Suite 13.3.0.1 or Autonomous Health Framework 26.x is in your stack, prioritize CVE-2026-70862 (CVSS 9.1, Application Testing Suite) and CVE-2026-70715 (CVSS 8.8, Autonomous Health Framework) first, per Oracle's risk matrices. Both are reachable without valid credentials.

• Confirm no clinical or device-adjacent system depends on any of the 23 patched product families. None was identified in this release, but log that check as part of your ongoing vendor patch tracking and risk analysis process, not as a one-off task tied to this single update.

Nothing in this release names a regulated medical device or a clinical Oracle product. The two flaws worth flagging, CVE-2026-70862 in Application Testing Suite and CVE-2026-70715 in Autonomous Health Framework, both sit inside general enterprise infrastructure that regulated organizations run without a second thought, and both are correctable this week.

Source

1. Oracle Critical Security Patch Update Advisory, August 2026, Oracle, August 18, 2026