Oracle has released the first security fixes in its new monthly Critical Security Patch Update (CSPU) cycle, designed to address urgent vulnerabilities that can’t wait for the company’s quarterly patching. The initial batch addresses 35 flaws, including several for which exploit code is publicly available.
In total, there are , ), Oracle E-Business Suite (), and Oracle Payments ( exists: , and in Oracle REST Data Services.
All relate to open source components embedded in Oracle products, and one, CVE-2025-58050, was first made public last August, underlining how long it can take to patch supply chain flaws in modern platforms.
Another priority fix should be CVE-2026-46840, with a perfect CVSS rating of ’10’. It’s a vulnerability in the backend-as-a-service component of REST Data Services versions 24.2.0 through 26.1.0.
REST Data Services is a gateway that exposes corporate databases via APIs. This flaw makes that interface easily exploitable by an unauthenticated attacker via HTTPS, resulting in a takeover of the gateway, making it a high priority for attackers.
Also deserving to be on the high priority list are the two flaws affecting the REST Data Services core, CVE-2026-46775 and CVE-2026-46839. Rated CVSS 9.9, all that stops these from being CVSS 10 flaws is the need for network credentials to exploit them.
Oracle ‘third Tuesday’
program or Claude Mythos, both of which Oracle has said it has access to, none of May’s vulnerability discoveries were attributed to these systems.
The change to a monthly update cycle brings Oracle into line with software vendors such as Microsoft and Adobe, and appears to be a reaction to the growth in the volume of more serious vulnerabilities now being reported.
In the future, the company will release CSPUs on the third Tuesday of each month, with the first four scheduled for June 16, July 21, August 18, and September 15. Oracle cloud customers are patched automatically.
SOCIAL SHARE CARD GENERATOR