cyber.hendryadrian.com
Security News · securityweek.com

Oracle’s October 2026 Patch Update Fixes 1,209 Unique CVEs

· Original article ↗

Summary

Oracle’s October 2026 Critical Patch Update includes 1,295 fixes addressing 1,209 unique CVEs, according to Tenable. Oracle did not flag any of the vulnerabilities as exploited in the wild.

Key points

  • The update covers dozens of Oracle products and includes 95 critical-, 439 high-, and 582 medium-severity CVEs, according to Tenable.
  • Oracle Fusion Middleware received the most fixes: 206, including 134 vulnerabilities reportedly exploitable remotely without authentication.
  • Oracle did not identify any of the vulnerabilities as exploited in the wild, while noting it periodically receives reports of exploitation attempts against its products.
  • Oracle separately published an advisory and security alert for CVE-2026-91403, described as its response to the eMudhra weak-key incident.
  • Oracle’s next CPU is scheduled for January 19, 2027; CSPUs are scheduled for November 17 and December 15.

Article Details

Event Type
Oracle released its October 2026 Critical Patch Update, providing 1,295 fixes across dozens of products.
Impact
Tenable reported that the update addresses 1,209 unique CVEs, including 95 critical-severity flaws. Oracle Fusion Middleware received the most fixes, with 206, including 134 remotely exploitable without authentication. Oracle did not flag any of the vulnerabilities as exploited in the wild.

CVE

CVE-2026-91403On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, which is Java’s (and Oracle’s) response to the eMudhra weak-key incident.

Vendors

OracleOracle has released its Critical Patch Update (CPU) for October 2026.TenableAccording to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws.

Products

E-Business SuiteA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).Java SEA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).JD EdwardsA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).MySQLA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).Oracle Fusion MiddlewareOracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication.Oracle WebLogicRelated: CISA Warns of Exploited Oracle WebLogic VulnerabilityPeopleSoftA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).Siebel CRMA significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).

Related Articles