Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Original title: Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
Oracle’s October 2026 Critical Patch Update contains 1,295 fixes across dozens of products. Tenable’s analysis says that covers 1,209 unique CVEs: 95 critical, 439 high, and 582 medium. Fusion Middleware received 206 fixes, 134 of them remotely exploitable without authentication. Oracle has not marked these flaws as exploited in the wild, while reminding customers it periodically hears of exploitation attempts. A separate alert, CVE-2026-91403, is Java and Oracle’s response to the eMudhra weak-key incident.
Unconfirmed: Oracle says it has not flagged these CPU vulnerabilities as exploited, while noting it sometimes receives reports of attempts against its products.
- E-Business Suite received 194 fixes and Siebel CRM 122.
- Communications got 110, PeopleSoft 109, JD Edwards 102, and MySQL 98.
- Java SE received 55 fixes and Supply Chain 50.
- Critical Security Patch Updates are set for November 17 and December 15.
- The next full CPU is scheduled for January 19, 2027.
Impact: Many flaws include unauthenticated remote exploitation
| Product | Affected | Fixed in |
|---|---|---|
| Oracle Fusion Middleware | — | October 2026 CPU |
| Oracle E-Business Suite | — | October 2026 CPU |
| Oracle Java SE | — | — |
- 1.Apply the October 2026 Critical Patch Update to affected Oracle products.
- 2.Review Oracle’s separate alert for CVE-2026-91403.
- CVEs
- CVE-2026-91403
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |
From the original article
1 min read at securityweek.com
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.