Oracle and Microsoft Unveil Massive 2026 Patch Updates Tackling Over 1,800 CVEs

On July 21, 2026 Oracle released its third quarterly Critical Patch Update for the year, addressing 1,235 unique CVEs across 1,449 security updates. The release included 261 critical patches covering 228 CVEs, with the Oracle E‑Business Suite receiving the highest number of patches (410).

In the same month Microsoft’s Patch Tuesday delivered more than 600 CVEs, marking its largest single‑month security release ever and tripling June’s count. Analysts note that AI‑driven vulnerability discovery is accelerating exploitation, with the 2026 Verizon DBIR identifying vulnerability exploitation as the leading cause of breaches for the first time in 19 years. Gartner reports a compression of the mean time between releases from 60 to 51 days since 2023, while the total CVE tally for 2026 is projected to approach 66,000.