Oracle’s Record 1,449-Patch CPU: When AI Runs the Security Arms Race

Oracle published its July 2026 Critical Patch Update (CPU) on July 21, making it the largest single quarterly security release in the company's history. The numbers are blunt: 1,449 patches addressing 1,235 unique CVEs across 334 products. For comparison, Oracle's July 2023 CPU — then considered unusually large — shipped 508 patches. This month nearly triples it.

The Scale

Of the 1,449 patches:

• 10 vulnerabilities carry a perfect CVSS 10.0 score — the maximum possible
• 541 can be exploited remotely without authentication
• 261 are rated critical severity
• 52.7% are rated high severity

E-Business Suite absorbed the largest slice (410 patches), followed by Fusion Middleware (355 — with 219 remotely exploitable without credentials), Communications (168), and PeopleSoft (84). MySQL received 54 patches. Java SE got only 19, but 17 of those are remotely exploitable — a 90% exploitability rate that's easy to miss when Java SE is bundled inside application servers and build toolchains rather than deployed standalone.

One of Those Tens Was Already in the Wild

Before Oracle shipped this patch set, the ShinyHunters threat group had quietly exploited two of the CVSS 10.0 vulnerabilities across a two-week campaign that ran May 27 through June 9. CVE-2026-35278 and CVE-2026-35273, both affecting Oracle PeopleSoft PeopleTools, chain together to deliver pre-authentication remote code execution — no credentials required, no user interaction needed.

ShinyHunters used the pair to compromise more than 300 PeopleSoft servers at over 100 organizations. Sixty-eight percent of victims were U.S. universities, which tend to expose PeopleSoft directly to the internet. Moody Bible Institute confirmed 2.3 million records exposed. The patch exists now. For those organizations, it arrived too late.

AI Is Running the Arms Race on Both Sides

Here is the part that reframes the whole picture. Oracle disclosed that it has integrated Anthropic's Claude Mythos Preview and OpenAI's most capable models into its internal security research workflows via a program called Trusted Access for Cyber. External researchers received credit for only a few dozen of the 1,235 CVEs in this release. The rest were found internally — with AI doing the heavy lifting.

This is a structural change. Historically, the CPU's size reflected human researcher throughput. Now it reflects what AI can analyze continuously at scale, without fatigue. The 1,449-patch total isn't a sign of Oracle becoming less secure; it's a sign that AI can surface latent flaws that were always there but would have taken years of human review to reach.

The problem is that the same technology is available to attackers. Researchers tracking exploit development timelines have documented a collapse: from 125 days average in January 2025 to roughly half a day by April 2026. The median time from public vulnerability disclosure to active exploitation in the wild dropped from 771 days in 2018 to under four hours by 2024. When Oracle publishes a CVSS 10.0 advisory on a Tuesday morning, assume a working exploit exists somewhere by Tuesday evening.

86% of the Problem Is Third-Party Components

A detail worth isolating: approximately 86% of this CPU's patches address CVEs in third-party open-source components that Oracle bundles — Apache Log4j, OpenSSL, Spring Framework, Netty, and dozens more. Oracle didn't write these vulnerabilities; it inherited them through the software supply chain.

This pattern shows up everywhere in enterprise software. Your vendor ships a product; buried inside are 40 open-source libraries, each with its own vulnerability cadence. When Oracle patches Log4j in Fusion Middleware, your Fusion Middleware deployment was exposed to that flaw whether you knew it or not. This is the argument for software bill of materials (SBOM) tooling: knowing which open-source components live inside your vendors' products before a CPU drops, not after.

What to Do This Week

• Inventory Oracle exposure now. Oracle Database, E-Business Suite, Fusion Middleware, PeopleSoft, WebLogic, Coherence, MySQL, and Java SE all need accounting. Java SE especially tends to slip through asset inventories when bundled with other applications.
• Patch CVSS 10.0 flaws first. CVE-2026-35278 and CVE-2026-35273 (PeopleSoft) are the confirmed exploited pair. CVE-2026-21962 (HTTP Server/WebLogic Proxy Plug-in), CVE-2026-35263 (WebLogic T3/IIOP protocol), and CVE-2026-61211 (Oracle Database DBMS_CLOUD, CVSS 9.9) are the next tier.
• Retire the 30-day patch window for critical flaws. With exploit development measured in hours, "next scheduled maintenance window in three weeks" is no longer a defensible posture for CVSS 9+ vulnerabilities.
• Ask your software vendors for SBOMs. If your business-critical application runs on Oracle middleware under the hood, you need to know before the next quarterly CPU, not after.

Falcon Internet runs production infrastructure on a 24x7x365 NOC monitoring model for exactly this reason: when CVSS 10.0 patches ship Tuesday morning and working exploits circulate by Tuesday evening, the relevant question is whether your monitoring is awake.