Siebel Security Patch Tracker: Oracle CPU and CSPU for Siebel CRM
Oracle now releases security patches for Siebel CRM every month. Quarterly Critical Patch Updates (CPU) ship in January, April, July and October. Critical Security Patch Updates (CSPU) ship in the months between. Both arrive on the third Tuesday of the month (the first CSPU, in May 2026, was the exception). The largest Siebel batch so far in 2026 is the October 2026 CPU: 122 Siebel CRM patches, 66 remotely exploitable without authentication, highest CVSS 9.9. The next release is the November 2026 CSPU on Tuesday, November 17, 2026. Its pre-release lists 19 Siebel CRM patches.
Upcoming Oracle security releases
| Date | Type | Siebel CRM content (pre-release) | Oracle page |
|---|---|---|---|
| Tue, Nov 17, 2026 | CSPU | 19 patches, 9 remote unauthenticated, highest CVSS 8.8, Siebel Applications 17.0–26.9 (pre-release, may change) – our Nov 15 pre-release post | Pre-release announcement – November 2026 |
| Tue, Dec 15, 2026 | CSPU | Not yet announced | Oracle Security Alerts |
| Tue, Jan 19, 2027 | CPU | Not yet announced | Oracle Security Alerts |
| Tue, Feb 16, 2027 | CSPU | Not yet announced | Oracle Security Alerts |
Dates come from the "next scheduled dates" list in Oracle's October 2026 CPU advisory.
2026 Siebel CRM security patches by release
| Release | Type | Released | Siebel CRM patches | Remote, no auth | Highest CVSS v3.1 | Siebel versions listed | Oracle advisory | Our coverage |
|---|---|---|---|---|---|---|---|---|
| October 2026 | CPU | Oct 20, 2026 | 122 | 66 | 9.9 | 17.0–26.8 | cpuoct2026 | Oct 18 pre-release post (with final-count update) |
| September 2026 | CSPU | Sep 15, 2026 | 63 | 26 | 9.1 | 17.0–26.7 | cspusep2026 | September CSPU post |
| August 2026 | CSPU | Aug 18, 2026 | 50 | 21 | 9.9 | 17.0–26.6 | cspuaug2026 | — |
| July 2026 | CPU | Jul 21, 2026 | 45 | 32 | 9.9 | 17.0–26.5 | cpujul2026 | — |
| June 2026 | CSPU | Jun 16, 2026 | 12 | 7 | 9.8 | 17.0–26.5 | cspujun2026 | — |
| May 2026 | CSPU | May 28, 2026 | 0 (no Siebel CRM section) | — | — | — | cspumay2026 | — |
| April 2026 | CPU | Apr 21, 2026 | 14 | 13 | 7.7 | 17.0–26.2 | cpuapr2026 | — |
| January 2026 | CPU | Jan 20, 2026 | 14 | 11 | 9.8 | 17.0–25.11 | cpujan2026 | — |
"Released" is the Rev 1 (initial release) date in each advisory's modification history. Counts are new security patches, not unique CVEs. Oracle also lists Oracle Enterprise Manager for Siebel separately in some advisories (for example, 13.5 and 24.1 in October 2026).
How to read a Siebel CPU or CSPU
- Siebel CRM patches: the number of new security patches Oracle lists in the "Oracle Siebel CRM Risk Matrix".
- Remote, no auth: how many of those Oracle says "may be remotely exploitable without authentication". Prioritize these.
- Highest CVSS: the top CVSS v3.1 base score in the Siebel matrix. That top-scoring issue isn't always one of the no-auth ones (in October 2026, the 9.9 needed low privileges; the highest no-auth score was 9.8).
- Versions listed: the supported Siebel Applications releases affected. Oracle sometimes revises this after release (October 2026 Rev 2 updated the Siebel versions to 17.0–26.8).
What Siebel teams should do each month
- Read the pre-release announcement (usually the Thursday before release) and book a non-production test window.
- On release day, check the Siebel CRM risk matrix and the patch availability document linked from the advisory.
- Test in non-production, then schedule production patching. Prioritize remote, no-auth issues.
- Track your Siebel monthly update level. Patches are listed against supported versions, so keeping current with 26.x updates matters. See our Siebel CRM 26.x release tracker.
Frequently asked questions
How many Siebel patches were in the October 2026 CPU?
122 new security patches for Oracle Siebel CRM. 66 may be remotely exploitable without authentication, and the highest CVSS v3.1 base score was 9.9 (Oracle).
When is the next Siebel security patch release?
The November 2026 Critical Security Patch Update is scheduled for Tuesday, November 17, 2026. Its pre-release lists 19 Siebel CRM patches (Oracle).
What is the difference between a CPU and a CSPU?
A CPU is Oracle's quarterly Critical Patch Update (January, April, July, October). A CSPU is a Critical Security Patch Update released in the months between. Both are listed on Oracle's Security Alerts page.
Which Siebel versions get the patches?
Each advisory lists the supported Siebel Applications versions affected. For October 2026 that is 17.0–26.8.
Need help testing and rolling out Siebel security patches or monthly updates? Bloomspire has supported Siebel CRM teams since 2010. Talk to us about Siebel consulting.
Related: Siebel Security / CSPU posts · Siebel CRM 26.x release tracker · Siebel Monitoring and Diagnostic Console explained
Last updated: November 15, 2026.