Oracle CPU October 2026: 1,295 patches and five priority CVEs

On 20 October 2026 Oracle released its October Critical Patch Update (CPU), the quarterly update that bundles security fixes for almost its entire catalogue: 1,295 new patches across dozens of product families, from Database Server to Fusion Middleware, from E-Business Suite to Java SE and MySQL. The release was reported by heise Security, SecurityWeek, Spain’s INCIBE-CERT and the Canadian Centre for Cyber Security (advisory AV26-1071).

At the moment none of the vulnerabilities is known to be exploited: Oracle has not flagged any as exploited in the wild, and INCIBE-CERT’s table marks “no” for all the priority CVEs. Several, however, are critical, reachable over the network and require no credentials.

The update in numbers

The number of patches is not the number of vulnerabilities, because the same CVE can be fixed in several products. According to Tenable’s analysis reported by SecurityWeek, the 1,295 patches address 1,209 unique CVEs: 95 critical, 439 high and 582 medium severity.

Breakdown by product family, again according to SecurityWeek:

• Fusion Middleware: 206 patches, 134 of them remotely exploitable without authentication;
• E-Business Suite: 194;
• Siebel CRM: 122;
• Communications: 110;
• PeopleSoft: 109;
• JD Edwards: 102;
• MySQL: 98;
• Java SE: 55;
• Supply Chain: 50.

Essbase, REST Data Services, Database Server, Enterprise Manager, GoldenGate, Secure Backup, TimesTen, APEX, NoSQL Database, SQL Developer and the financial services, retail, healthcare and hospitality applications also received patches. The full list of affected products is in the Canadian Centre’s advisory: it also includes WebLogic Server, Oracle HTTP Server, Identity Manager, Managed File Transfer, GraalVM, Solaris, VirtualBox, ZFS Storage Appliance Kit and several network functions of the Communications Cloud Native Core line.

Priority vulnerabilities

INCIBE-CERT rates the update with importance 5 – critical and highlights five CVEs:

• CVE-2026-101809 (CVSS 3.1: 10.0), in the Workflow Notification Mailer of Oracle E-Business Suite, versions 12.2.3 to 12.2.15: exploitable over HTTP without authentication.
• CVE-2026-91216 and CVE-2026-91221 (CVSS 3.1: 10.0), in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0: an unauthenticated attacker with network access via T3 or IIOP can compromise the product.
• CVE-2026-87337 (CVSS 3.1: 10.0), in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0: remotely exploitable over HTTP without authentication.
• CVE-2026-75803 (CVSS 3.1: 9.8), in the OpenSSL component of Oracle Database Server, versions 19.3 to 19.32 and 23.4.0 to 23.26.3: remotely exploitable without authentication via TLS.

In CVSS 3.1 a score of 10.0 means a network attack of low complexity, with no privileges or user interaction required, and maximum impact on confidentiality, integrity and availability extending beyond the vulnerable component. Details of products, versions and applicable patches are in Oracle’s risk matrix, which INCIBE-CERT recommends consulting.

MITRE ATT&CK (our classification): T1190 (Exploit Public-Facing Application) for the flaws exploitable over HTTP, T3 or IIOP without authentication.

Java and the eMudhra case

On 21 October, the day after the CPU, Oracle published a separate advisory and Security Alert for CVE-2026-91403: according to SecurityWeek, this is Java’s (and Oracle’s) response to the weak private key incident at the eMudhra certificate authority. Anyone updating Java SE with the CPU should therefore apply this follow-up update as well.

Impact for European and Italian companies

Oracle databases, middleware and business applications support core processes in many companies: administration, logistics, manufacturing, banking and insurance. An update of this size needs to be planned by priority.

• For NIS2 entities, vulnerability handling is one of the security measures required by Article 21: the timing and criteria for applying the CPU should be decided and documented.
• In healthcare, the Canadian advisory lists Healthcare Master Person Index, Healthcare Data Repository and Health Sciences Information Manager.
• Telecom operators will find several Cloud Native Core network functions on the list, including Network Repository Function, Network Slice Selection Function, Security Edge Protection Proxy and Unified Data Repository.

Oracle reminds customers that it periodically receives reports of exploitation attempts targeting its products. The precedent is recent: in September the ShinyHunters group stole data on FBI personnel through an unpatched PeopleSoft system, as reported by ARX News.

What to do now

1. Take inventory of Oracle products and installed versions, including the less visible components: WebLogic Server underneath third-party applications, MySQL, Java SE and GraalVM on servers and workstations, VirtualBox on developers’ computers. Compare the list with the CPU risk matrix.
2. Start with network-reachable systems in the listed versions: E-Business Suite, Access Manager, SOA Suite and Database Server.
3. Restrict T3 and IIOP: until SOA Suite is updated, make sure these protocols are not reachable from the Internet or from untrusted networks.
4. Update Java SE with the CPU and also apply the advisory for CVE-2026-91403.
5. Stay on actively supported versions, as INCIBE-CERT recommends: patches are listed in Oracle’s availability matrix, with installation instructions for each product.
6. Monitor the logs of E-Business Suite, Access Manager and WebLogic servers: anomalous requests from external addresses and unexpected T3 or IIOP traffic.
7. Mark the next dates: Critical Security Patch Updates (CSPU) on 17 November and 15 December (the third Tuesday of each month), next CPU on 19 January 2027.

How ARXDOME helps

ARX Shield shows, for each monitored machine, the open vulnerabilities by package, highlighting those already exploited and the disconnected machines with critical vulnerabilities: it helps you see where the update is still missing. ARX Expose and ARX Scout show which of your company’s services are exposed to the Internet and which ports are actually open, so you can decide where to start.

Last updated: 22 October 2026