Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Original title: Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
Oracle’s October Critical Patch Update fixes 1,295 vulnerabilities, including six scored 10.0 on CVSS 3.1. CVE-2026-101809 lets an unauthenticated HTTP attacker compromise the E-Business Suite Workflow notification mailer. Three SOA Suite flaws and an Access Manager flaw allow unauthenticated compromise over HTTP or T3/IIOP, and CVE-2026-91299 can take over JD Edwards EnterpriseOne Orchestrator. The article does not say whether any of the flaws are being exploited.
Unconfirmed: Fixed version numbers are not stated, and exploitation status is not discussed.
- Workflow versions 12.2.3 through 12.2.15 are affected by CVE-2026-101809.
- SOA Suite CVSS 10.0 bugs are CVE-2026-91231, CVE-2026-91216, and CVE-2026-91221.
- Those SOA bugs affect supported versions 12.2.1.4.0 and 14.1.2.0.0.
- Access Manager CVE-2026-87337 affects 12.2.1.4.0 and 14.1.2.1.0.
- Orchestrator CVE-2026-91299 affects versions 9.2.0.0 through 9.2.26.5.
Impact: Unauthenticated remote compromise and takeover of affected Oracle products
| Product | Affected |
|---|---|
| Oracle E-Business Suite Workflow | 12.2.3 through 12.2.15 |
| Oracle SOA Suite | 12.2.1.4.0 and 14.1.2.0.0 |
| Oracle Access Manager | 12.2.1.4.0 and 14.1.2.1.0 |
| Oracle JD Edwards EnterpriseOne Orchestrator | 9.2.0.0 through 9.2.26.5 |
- 1.Apply Oracle’s October Critical Patch Update to affected products.
- Vendors
- Oracle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101809 | Unauthenticated Workflow takeover in Oracle E-Business Suite | 10.0 | — | ||
| CVE-2026-87337 | Unauthenticated data access and modification in Oracle Access Manager | 10.0 | — | ||
CVE-2026-91216+2 related CVEs | Unauthenticated takeover in Oracle SOA Suite Fabric Layer | 10.0 | — | ||
| CVE-2026-91299 | Unauthenticated takeover in JD Edwards EnterpriseOne Orchestrator | 10.0 | — |
From the original article
1 min read at csoonline.com
Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10. 0 on the CVSS version 3. 1 scale.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.