Oracle October 2026 CPU fixes unauthenticated E-Business Suite takeover bug
Original title: Massive Oracle Security Update – 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
Oracle published its October 2026 Critical Patch Update on October 20, listing 1,295 security patches. Tenable counts 1,209 unique CVEs across 33 product families, noting one flaw can appear in several matrices. CVE-2026-101809 lets an unauthenticated attacker over HTTP take over E-Business Suite Workflow Notification Mailer in versions 12.2.3 through 12.2.15. Separate CVSS 9.8 issues affect Application Object Library, Database Server OpenSSL, and APEX. Earlier exploitation reports are not tied to these new flaws.
Unconfirmed: The report does not confirm exploitation of the newly disclosed CVEs; Oracle’s warning about attacks on unpatched customers is not tied to them.
- CVE-2026-101767 affects Application Object Library Core in 12.2.3 through 12.2.15 over HTTP.
- CVE-2026-75803 affects Database OpenSSL in 19.3–19.32 and 23.4.0–23.26.3 via TLS.
- CVE-2026-101521 affects APEX ranges 24.1, 24.2, and 26.1 and is reachable over HTTPS.
- Oracle says attacks continue against customers who have not installed available patches.
Impact: Unauthenticated remote takeover of affected Oracle components
| Product | Affected |
|---|---|
| Oracle E-Business Suite Workflow Notification Mailer | 12.2.3 through 12.2.15 |
| Oracle Application Object Library Core | 12.2.3 through 12.2.15 |
| Oracle Database Server OpenSSL component | 19.3 through 19.32 and 23.4.0 through 23.26.3 |
| Oracle APEX | 24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4 |
- 1.Apply the October 2026 Critical Patch Update and stay on supported versions.
- 2.Check installed versions against Oracle’s affected-product tables, including Database and Fusion Middleware.
- 3.Treat temporary network restrictions as short-term protection only after testing.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101521 | Missing authentication allows unauthenticated takeover of Oracle APEX | 9.8 | — | ||
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | — | ||
| CVE-2026-101809 | Unauthenticated Workflow takeover in Oracle E-Business Suite | 10.0 | — | ||
| CVE-2026-75803 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the… | 9.1 | <1% |
From the original article
2 min read at cybersecuritynews.com
Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across its software portfolio. Published on October 20. The update includes a maximum-severity Oracle E-Business Suite vulnerability that allows attackers without login credentials to take over an affected Workflow component through network access.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.