This Critical Security Patch Update (CSPU) for September 2026 contains no patches for JD Edwards EnterpriseOne itself, but includes critical updates for Oracle Database, WebLogic Server, and BI Publisher, which are key components of the JD Edwards technology stack.
What’s new
Oracle Database
The update provides 11 new security patches for Oracle Database Products, with 5 vulnerabilities that can be exploited remotely without authentication. The highest CVSS score is 8.8, associated with CVE-2026-83348 in RDBMS (Create DB Link). Affected versions include 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Client-only patches are also included.
| CVE | Component | CVSS | Remote without auth | Affected versions |
|---|---|---|---|---|
| CVE-2026-83348 | RDBMS (Create DB Link) | 8.8 | No | 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83160 | RDBMS (Create Table) | 8.8 | No | 23.4.0-23.26.3 |
| CVE-2026-83271 | RDBMS (Execute on DBMS_REDEFINITION) | 8.8 | No | 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83272 | Oracle Text (Create Index) | 8.5 | No | 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83351 | RDBMS | 8.1 | Yes | 23.4.0-23.26.3 |
| CVE-2026-83088 | RDBMS (Authenticated User) | 7.7 | No | 23.4.0-23.26.3 |
| CVE-2026-83349 | Oracle Net Services (Connection Manager) | 7.5 | Yes | 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83350 | Oracle Net Services (Connection Manager) | 7.5 | Yes | 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83333 | Oracle Net Services (Listener) | 7.5 | Yes | 23.4.0-23.26.3 |
| CVE-2026-83156 | Oracle XML Developers Kit (XDKC) | 7.5 | No | 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3 |
| CVE-2026-83347 | Oracle Net Services (Listener) | 6.5 | Yes | 23.4.0-23.26.3 |
WebLogic Server
WebLogic Server receives 5 patches, with 4 vulnerabilities exploitable remotely without authentication. The most severe is CVE-2026-83021 in the Web Container, with a CVSS score of 10.0. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
| CVE | Component | CVSS | Remote without auth | Affected versions |
|---|---|---|---|---|
| CVE-2026-83021 | Web Container | 10.0 | Yes | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 |
| CVE-2026-83038 | TopLink Integration | 9.9 | No | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 |
| CVE-2026-70756 | Core | 9.8 | Yes | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 |
| CVE-2026-70757 | Core | 9.8 | Yes | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 |
| CVE-2026-70748 | Core | 9.8 | Yes | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 |
BI Publisher
BI Publisher is addressed with 20 patches, 3 of which are remotely exploitable without authentication. The highest CVSS score is 9.8, related to CVE-2026-83269 in BI Platform Security. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
| CVE | Component | CVSS | Remote without auth | Affected versions |
|---|---|---|---|---|
| CVE-2026-83269 | BI Platform Security | 9.8 | Yes | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83268 | BI Platform Security | 9.1 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83315 | BI Platform Security | 8.8 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83310 | BI Platform Security | 8.7 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83305 | BI Platform Security | 8.6 | Yes | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83284 | BI Platform Security | 8.6 | Yes | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83267 | BI Publisher Security | 8.5 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83302 | BI Publisher Security | 8.5 | No | 12.2.1.4.0 |
| CVE-2026-83309 | Web Server | 8.5 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83303 | BI Platform Security | 8.5 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83311 | BI Platform Security | 8.5 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83307 | BI Platform Security | 8.3 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83297 | BI Platform Security | 8.1 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83308 | BI Platform Security | 8.1 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83314 | Web Service API | 8.1 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83313 | BI Platform Security | 7.7 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83319 | Web Service API | 7.7 | No | 12.2.1.4.0 |
| CVE-2026-83320 | Administration | 7.6 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83318 | Administration | 7.5 | No | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 |
| CVE-2026-83298 | BI Platform Security | 7.2 | No | 12.2.1.4.0 |
Who should care
If your JD Edwards environment uses Oracle Database versions 19.3-19.32, 21.3-21.23, or 23.4.0-23.26.3, these patches are relevant. Client-only installations also require attention.
If your JD Edwards HTML Server, AIS Server, BSSV, or Orchestrator Studio runs on WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, apply these patches.
For JD Edwards environments utilizing BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0, these updates are critical.
What to do now
- Prioritize applying the WebLogic Server patch for CVE-2026-83021 (CVSS 10.0) and BI Publisher patch for CVE-2026-83269 (CVSS 9.8).
- Address the Oracle Database patch for CVE-2026-83348 (CVSS 8.8) and other high-severity patches.
- Compare affected versions with your current Tools Release, WebLogic, JDK, and database configurations.
- Download the necessary patches from My Oracle Support and coordinate with your CNC administrator and DBA for deployment.
- Test patches in your DV/PY environments before applying them to production.
- Oracle’s next release is the CPU on 20 October 2026 – plan your next patch window accordingly.
Source: Oracle Critical Security Patch Update Advisory – September 2026