Oracle October 2026 CPU: 1,295 patches, six CVSS 10.0 flaws in EBS, SOA Suite

Oracle's October 2026 Critical Patch Update, released on 20 October, contains 1,295 new security patches, including six flaws that score the maximum 10.0 on the CVSS 3.1 scale and can be reached over the network without logging in. They affect E-Business Suite, Access Manager, SOA Suite and JD Edwards EnterpriseOne Orchestrator. Oracle has not said any of them is being exploited, but it repeats its standing warning that attackers have succeeded against customers who did not apply patches that were available.

Key points

• The update has 1,295 new security patches, which Tenable counts as 1,209 unique CVEs across 33 product families; Oracle's own advisory lists the patches by product family.
• Six CVEs score CVSS 10.0, all marked by Oracle as exploitable remotely without authentication: CVE-2026-101809, CVE-2026-87337, CVE-2026-91231, CVE-2026-91216, CVE-2026-91221 and CVE-2026-91299.
• Fusion Middleware has the most patches (206, of which 134 may be exploitable remotely without authentication), followed by E-Business Suite (194).
• Java SE gets 55 patches, 49 of them remotely exploitable without authentication; MySQL gets 98, 29 of them.
• Oracle's advisory does not state that any of these flaws is under attack. Tenable's analysis counts 112 of the patches as critical, covering 95 CVEs.

What to do

• Find your Oracle products. List every Oracle product and version, including the ones bundled inside others (E-Business Suite includes Oracle Database and Fusion Middleware components).
• Patch the six first. Affected versions per Oracle's risk matrices: E-Business Suite Workflow Notification Mailer 12.2.3 to 12.2.15 (CVE-2026-101809, HTTP); Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (CVE-2026-87337, HTTP); Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 (CVE-2026-91231 over HTTP, CVE-2026-91216 and CVE-2026-91221 over T3 and IIOP); JD Edwards EnterpriseOne Orchestrator 9.2.0.0 to 9.2.26.5 (CVE-2026-91299, HTTP).
• Reduce exposure while you schedule patching. Prioritise internet-facing authentication, workflow and application services, and limit access to HTTP, T3 and IIOP endpoints that do not need to be public. This does not replace patching.
• E-Business Suite owners: check the Database and Fusion Middleware updates separately, because they are not in the E-Business Suite risk matrix.
• Java and MySQL users: Oracle's Java SE list for this update includes versions 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27. MySQL Server entries include 8.4.0 to 8.4.12, 9.7.0 to 9.7.3 and 26.7.0 to 26.7.1.
• After patching: verify patch levels, test key functions, and review logs without assuming you were compromised.

What happened

Oracle publishes a Critical Patch Update every quarter, a collection of patches for vulnerabilities in its own code and in third-party components it ships. The October 2026 advisory says it contains 1,295 new security patches across the product families it lists. Oracle's description is that the patches are cumulative, but each advisory only lists what was added since the previous one, so earlier advisories matter for anyone behind on patching.

Tenable's research team, in a post dated 20 October, counted the same 1,295 patches as 1,209 unique CVEs, because some CVEs are fixed in more than one product. It rates 112 of the patches (8.6%) as critical, covering 95 unique CVEs. eSecurity Planet's report, which relies on Tenable's numbers, adds that all six CVSS 10.0 flaws are potentially exploitable remotely without authentication.

We checked the six against Oracle's risk matrices. Each is scored 10.0 with network access, low complexity, no privileges and no user interaction required, and a "changed" scope, which means a successful attack can affect components beyond the vulnerable one. Five of the six rate confidentiality, integrity and availability impact as high; the Access Manager flaw (CVE-2026-87337) rates availability impact as none, and still scores 10.0.

Background

Oracle patches on a fixed quarterly cycle, and the advisory is long by design: it is a catalogue of fixes across databases, applications, middleware, communications software and developer tools. The size is mostly a product of how many families it covers, so the headline number says less than the per-product lists do.

Java developers may have seen a related notice this week. We covered the OpenJDK October 2026 advisory and Corretto 25.0.5, which is a separate publication from Oracle's own list of Java SE patches.

The numbers

The largest product families by patch count show where the work concentrates. Oracle's advisory gives these counts directly.

Oracle Fusion Middleware206

Oracle E-Business Suite194

Oracle Siebel CRM122

Oracle Communications110

Oracle JD Edwards102

Oracle MySQL98

Oracle Java SE55

New security patches by product family, October 2026 CPU (largest of the families we checked) (patches)

	patches
Oracle Fusion Middleware	206
Oracle E-Business Suite	194
Oracle Siebel CRM	122
Oracle Communications	110
Oracle JD Edwards	102
Oracle MySQL	98
Oracle Java SE	55

Source: Oracle Critical Patch Update Advisory, October 2026

Remote reach matters more than the totals. Of Fusion Middleware's 206 patches, Oracle says 134 may be exploited over a network without credentials. For E-Business Suite the figure is 31 of 194, for MySQL 29 of 98, and for Java SE 49 of 55. For Java SE, Oracle adds that its CVSS scores assume that a user running a Java applet or Web Start application has administrator privileges, as is typical on Windows; without that, the scores can be lower, which matters for server installations.

What it means

For administrators of Oracle middleware, the six 10.0 flaws are the priority because they sit in components that often face the internet: login handling (Access Manager), workflow mail (E-Business Suite) and integration endpoints (SOA Suite, JD Edwards Orchestrator). Two of the SOA Suite flaws involve the T3 and IIOP protocols, so the practical step is to confirm those ports are not reachable from outside your network.

For smaller teams, the main cost is inventory. Fusion Middleware components appear inside other Oracle products, so a team that thinks it only runs E-Business Suite may also need the middleware and database updates.

For everyone else, the Java SE and MySQL numbers show how many flaws are rated remotely exploitable without authentication (49 of 55 and 29 of 98). Whether that reaches you depends on how you use the product, and Oracle's note on Java scoring (above) is the place to start.

What we don't know yet

• Whether any of the six CVSS 10.0 flaws is being exploited. Oracle has not said so, and eSecurity Planet notes that potential exploitability does not establish that attacks have occurred.
• Technical details. Oracle's advisory gives scores, components and protocols, not descriptions of how each flaw works.
• Whether public exploit code will appear. We found none in the sources we read.
• Why different outlets report different totals; we use Oracle's 1,295 patches and Tenable's 1,209 unique CVEs and have not verified other counts.

What to watch next

Watch for proof-of-concept code and exploitation reports for the SOA Suite and Access Manager flaws, for the CISA known-exploited list, and for Oracle's next quarterly update. If your products are on versions outside the supported list, Oracle's advice is to move to an actively supported version first.

Sources

• Oracle Critical Patch Update Advisory, October 2026 (primary source)
• Tenable: Oracle October 2026 Critical Patch Update Addresses 1209 CVEs (20 October 2026)
• eSecurity Planet: Oracle Patches 1,209 Security Flaws, Including Six CVSS 10.0 Bugs