Oracle's October 2026 patch update fixes 1,209 CVEs, including six rated CVSS 10.0

Oracle released its October 2026 Critical Patch Update (CPU) on Tuesday, October 20, the company's final quarterly security release of the year. According to an analysis by Tenable published on Security Boulevard, the update contains 1,295 security patches addressing 1,209 unique CVEs across 33 product families. SecurityOnline reported that six of the flaws carry the maximum CVSS score of 10.0 and can be exploited remotely without authentication, making the release a priority for organizations running Oracle middleware and business applications.

What happened

Tenable said 112 of the patches (about 8.6%) are rated critical, 475 high, 613 medium and 95 low. Fusion Middleware received the largest share with 206 patches, 134 of which address flaws exploitable remotely without credentials. E-Business Suite followed with 194 patches, then Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102) and MySQL (98). SecurityOnline counted 562 entries describing bugs that a remote attacker can exploit without credentials. Figures for some product families differ slightly between the published analyses.

Technical details

According to SecurityOnline, the six CVSS 10.0 flaws are:

• CVE-2026-101809 in the E-Business Suite Workflow Notification Mailer (HTTP)
• CVE-2026-87337 in the Oracle Access Manager authentication engine (HTTP)
• CVE-2026-91216 and CVE-2026-91221 in the Oracle SOA Suite Fabric Layer (T3, IIOP)
• CVE-2026-91231 in Oracle SOA Suite Adapters (HTTP)
• CVE-2026-91299 in JD Edwards EnterpriseOne Orchestrator (HTTP)

The outlet said the Access Manager bug could give an unauthenticated attacker full read and write access to Access Manager data, with potential impact on connected applications, while Oracle says the SOA Suite flaws can lead to full takeover of the product. WebLogic Server received 11 patches, all remotely exploitable without authentication, including two core flaws rated 9.8: CVE-2026-83399 over T3 and IIOP and CVE-2026-91323 over HTTP. Other highlights include a 9.8-rated OpenSSL-related flaw in Database Server (CVE-2026-75803) and a 9.8-rated APEX bug (CVE-2026-101521). Java SE received 55 patches, 49 of them remotely exploitable without authentication, but none rated critical.

Who is affected

Organizations running Oracle Fusion Middleware (WebLogic, SOA Suite, Access Manager), E-Business Suite, JD Edwards, Siebel, PeopleSoft, MySQL, Database Server and Java SE are affected. SecurityOnline said Oracle's risk matrices do not flag any of the flaws as exploited in the wild and no public proof-of-concept code has been confirmed. However, the outlet noted that attackers have often reverse-engineered Oracle patches within days in past cycles.

What to do

Oracle advises customers to apply the relevant patches from its October 2026 advisory. SecurityOnline recommends patching internet-facing WebLogic, SOA Suite, Access Manager and E-Business Suite servers first, then all remaining remotely exploitable unauthenticated flaws, and internal systems such as Database Server, MySQL and Java SE in the next maintenance window. Where patching must be delayed, administrators should block T3 and IIOP traffic from untrusted networks, for example with WebLogic connection filters, keep administrative consoles and SOA endpoints off the public internet, and monitor Access Manager logs for unusual authentication requests. Oracle's next CPU is scheduled for January 19, 2027.