Oracle October 2026 Critical Patch Update released: 1,295 new security patches, with six CVSS 10.0 flaws open to unauthenticated network attack in E-Business Suite, Oracle Access Manager, SOA Suite and JD Edwards, and 9.8 fixes for WebLogic Server, APEX, MySQL and Database Server
Oracle released its quarterly Critical Patch Update for October 2026 on 20 October (US time; early 21 October in Australia). The advisory (Rev 1) contains 1,295 new security patches, slightly more than the 1,283 in the 15 October pre-release notice. The largest groups are Oracle Fusion Middleware (206 patches, 134 remotely exploitable without authentication), E-Business Suite (194; 31), Database products (126 in total, including 14 for Oracle Database Server, 38 for Essbase and 35 for REST Data Services), Siebel CRM (122; 66), Communications (110; 77), PeopleSoft (109; 41), JD Edwards (102; 44), MySQL (98; 29) and Java SE (55; 49). Six flaws carry the maximum CVSS 3.1 score of 10.0, all reachable over the network without credentials: CVE-2026-101809 in the E-Business Suite Workflow Notification Mailer (12.2.3 to 12.2.15, HTTP); CVE-2026-87337 in the Oracle Access Manager authentication engine (12.2.1.4.0 and 14.1.2.1.0, HTTP); CVE-2026-91231 (Adapters, HTTP), CVE-2026-91216 and CVE-2026-91221 (Fabric Layer, T3/IIOP) in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0; and CVE-2026-91299 in JD Edwards EnterpriseOne Orchestrator security (9.2.0.0 to 9.2.26.5). Unauthenticated 9.8 fixes include Oracle WebLogic Server core CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3/IIOP) for 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; a second Access Manager flaw over SAML (CVE-2026-87251); the E-Business Suite Application Object Library (CVE-2026-101767); Oracle Identity Manager (CVE-2026-91408); Oracle APEX (CVE-2026-101521); several SOA Suite, Data Integrator, WebCenter and Managed File Transfer issues; an OpenSSL component flaw in Oracle Database Server (CVE-2026-75803, 19.3 to 19.32 and 23.4.0 to 23.26.3); OpenSSL and curl component fixes in MySQL Server and MySQL Enterprise Backup; PeopleSoft PeopleTools (CVE-2026-33466, Logstash component); and Oracle Solaris (CVE-2026-60432 in the Image Packaging System and CVE-2026-101537). Java SE fixes top out at 7.5 and cover Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27 plus GraalVM. Oracle does not say any of these flaws are being exploited, but repeats its warning that attackers keep succeeding against customers who have not applied earlier patches. PeopleSoft was hit by a renewed mass-exploitation campaign in September (CVE-2026-35273). Oracle's next releases are monthly Critical Security Patch Updates on 17 November and 15 December 2026, with the next quarterly CPU on 19 January 2027. Primary: Oracle CPU advisory (20 Oct). Oracle is on this desk's vendor watchlist.
- Product
- Oracle product families in the October 2026 CPU: E-Business Suite, Fusion Middleware (WebLogic Server, SOA Suite, Access Manager, Identity Manager, WebCenter, Data Integrator, Managed File Transfer), JD Edwards, PeopleSoft, Siebel CRM, Communications, Database Server, APEX, Essbase, MySQL, Java SE, Solaris and others
- Versions
- Per Oracle risk matrices, for example: E-Business Suite 12.2.3–12.2.15; Access Manager 12.2.1.4.0, 14.1.2.1.0; SOA Suite 12.2.1.4.0, 14.1.2.0.0; WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0; JD Edwards EnterpriseOne Orchestrator/Tools 9.2.0.0–9.2.26.5; Database Server 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3; MySQL Server 8.4.0–8.4.12, 9.7.0–9.7.3, 26.7.0–26.7.1; Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27
- CVSS
- Up to 10.0 (CVSS 3.1, Oracle): CVE-2026-101809, CVE-2026-87337, CVE-2026-91231, CVE-2026-91216, CVE-2026-91221, CVE-2026-91299
- Exploited in Australia?
- unknown
- Patch to
- Apply the October 2026 CPU patches listed in each product's Patch Availability Document. Patch internet-facing E-Business Suite (Workflow Notification Mailer), Oracle Access Manager, SOA Suite, WebLogic Server (block T3/IIOP from the internet) and JD Edwards Orchestrator first, then PeopleSoft, APEX, Identity Manager, Database Server, MySQL and Java SE fleets. Versions outside Premier or Extended Support get no patches, so upgrade them.
Primary: Oracle — Critical Patch Update Advisory, October 2026 (Rev 1, 20 Oct 2026) · Vendor: Oracle Critical Patch Updates, Security Alerts and Bulletins · CVE: CVE-2026-101809, CVE-2026-87337, CVE-2026-91231, CVE-2026-91216, CVE-2026-91221, CVE-2026-91299, CVE-2026-91323, CVE-2026-83399, CVE-2026-87251, CVE-2026-101767, CVE-2026-91408, CVE-2026-101521, CVE-2026-75803, CVE-2026-33466, CVE-2026-60432, CVE-2026-101537, CVE-2026-35273