Oracle October 2026 Critical Patch Update lands Tuesday 20 October: pre-release notice lists 1,283 new security patches, with CVSS 10.0 issues in E-Business Suite, Fusion Middleware and JD Edwards
Oracle published its Critical Patch Update Pre-Release Announcement for October 2026 on 15 October (US time), giving advance notice that the quarterly CPU will be released on Tuesday 20 October 2026 (early Wednesday 21 October in Australia) and will contain 1,283 new security patches across its product families. Oracle notes the pre-release figures can change before the advisory is published. The biggest buckets are Oracle E-Business Suite and Oracle Fusion Middleware (196 patches each; 34 and 132 of them remotely exploitable without authentication respectively), Oracle Communications (124; 87 unauthenticated remote), Oracle Siebel CRM (123; 67), Oracle PeopleSoft (109), Oracle JD Edwards (102; 44), Oracle MySQL (98) and Oracle Java SE (55; 49). The highest CVSS 3.1 base scores Oracle lists are 10.0 for E-Business Suite, Fusion Middleware and JD Edwards; 9.9 for Siebel CRM, Essbase, Enterprise Manager and Trusted Answer Search; and 9.8 for APEX, Autonomous Health Framework, Secure Backup, Communications, HealthCare Applications, MySQL, PeopleSoft and Oracle Systems. Oracle Database Server gets 13 patches with a top score of 8.8. CVE identifiers and per-product affected versions are only published with the advisory itself. Oracle is on this desk's vendor watchlist.
- Product
- Oracle product families covered by the October 2026 CPU (E-Business Suite, Fusion Middleware incl. WebLogic, JD Edwards, PeopleSoft, Siebel CRM, Communications, MySQL, Java SE, Database Server, Essbase, Enterprise Manager and others)
- Versions
- Per-product affected versions are listed in the pre-release announcement; final CVE-level detail arrives with the CPU advisory on 20 October 2026 (US). Figures may change before release.
- CVSS
- Up to 10.0 (CVSS 3.1, Oracle) — E-Business Suite, Fusion Middleware, JD Edwards
- Exploited in Australia?
- unknown
- Patch to
- Plan patch windows for 21 October (AWST/AEST) now. Prioritise internet-facing E-Business Suite, PeopleSoft, WebLogic/Fusion Middleware and JD Edwards, then MySQL and Java SE fleets. Pull the CPU advisory on release day for CVE lists and fixed versions; do not patch from the pre-release alone.
Primary: Oracle — Critical Patch Update Pre-Release Announcement, October 2026 (page updated 15 Oct 2026; CPU due 20 Oct 2026) · Vendor: Oracle Critical Patch Updates, Security Alerts and Bulletins