Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across the affected Oracle product families.
The Fortra Intelligence and Research Experts (FIRE) team is reviewing the release and prioritizing coverage for vulnerabilities that combine remote reachability, low attack complexity, and high business impact.
At a Glance
| Metric | Value |
|---|---|
| New security patches | 1,295 |
| Unique CVEs in the risk matrices | 1,209 |
| Remotely exploitable without authentication | 519 unique CVEs |
| CVSS 9.0 or higher | 95 unique CVEs |
| Highest CVSS 3.1 base score | 10.0 |
Vulnerabilities to Watch
Oracle Access Manager | Authentication Engine | CVSS 10.0 | HTTP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 12.2.1.4.0, 14.1.2.1.0
This unauthenticated, network-based vulnerability could allow a successful attacker to create, delete, or modify all Oracle Access Manager accessible data via HTTP.
Workflow | Workflow Notification Mailer | CVSS 10.0 | HTTP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 12.2.3-12.2.15
This unauthenticated, network-based vulnerability could allow an attacker to fully takeover the Workflow application via HTTP.
Oracle SOA Suite | Adapters | CVSS 10.0 | HTTP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 12.2.1.4.0, 14.1.2.0.0
This unauthenticated, network-based vulnerability could lead to a complete compromise of the Oracle SOA Suite, software used to build, deploy, and manage service-oriented architecture (SOA) integrations via HTTP.
Oracle SOA Suite | Fabric Layer | CVSS 10.0 | T3, IIOP
Remote without authentication | Complexity: Low | User interaction: None
Affected versions: 12.2.1.4.0, 14.1.2.0.0
This unauthenticated, network-based vulnerability could lead to a complete compromise of the Oracle SOA suite via the T3 and IIOP protocols. T3 is a WebLogic proprietary transport protocol, while IIOP is the Internet Inter-ORB protocol also used by WebLogic.
Product Family Breakdown
The table shows the product families with the most risk-matrix entries. Counts are entries rather than unique CVEs; the same CVE may appear across products. Review Oracle's full risk matrices and Patch Availability Documents for complete product and version details.
| Product family | Entries | Remote / no auth | Max CVSS |
|---|---|---|---|
| Oracle Fusion Middleware | 206 | 134 | 10.0 |
| Oracle E-Business Suite | 194 | 31 | 10.0 |
| Oracle Siebel CRM | 122 | 66 | 9.9 |
| Oracle Communications | 110 | 77 | 9.8 |
| Oracle PeopleSoft | 109 | 41 | 9.8 |
| Oracle JD Edwards | 102 | 44 | 10.0 |
| Oracle MySQL | 98 | 29 | 9.8 |
| Oracle Java SE | 55 | 49 | 7.5 |
| Oracle Supply Chain | 50 | 19 | 9.3 |
| Oracle Essbase | 38 | 14 | 9.9 |
Remediation Guidance
Organizations should inventory affected Oracle products and versions, review the applicable Patch Availability Documents in My Oracle Support, and prioritize internet-facing or otherwise exposed systems. Particular attention should be given to unauthenticated network vulnerabilities with low attack complexity and high confidentiality, integrity, or availability impacts.
Oracle Critical Patch Updates are cumulative, but each advisory describes only the security patches added since the previous CPU. Organizations that have missed earlier updates should review prior CPU and CSPU advisories and bring supported systems fully current.
Where immediate patching is not possible, reduce exposure to affected protocols, restrict unnecessary privileges, monitor for suspicious activity, and test temporary changes before production use. These measures do not replace applying the Critical Patch Update.
Sources
Oracle advisory: https://www.oracle.com/security-alerts/cpuoct2026.html
Text-form risk matrices: https://www.oracle.com/security-alerts/cpuoct2026verbose.html
Oracle security advisories index: https://www.oracle.com/security-alerts/
