Oracle October 2026 CPU issues 1,295 patches, including CVSS 9.8 flaws

Original title: Oracle Releases 1,295 Security Patches to Fix Critical Vulnerabilities Across Multiple Products

GBHackersby DivyaOct 21, 2026 · 09:18 UTC (4d ago)3 min read3 · 2 reads

AI summary · x-ai/grok-4.7Summaries by Vani AI

Six hundred ninety patches are remotely exploitable without authentication, spanning database, middleware, Java and applications.

Oracle’s October 20, 2026 Critical Patch Update adds 1,295 security patches across its portfolio and third-party components. Named critical issues include unauthenticated network flaws in Database Server OpenSSL, APEX and Essbase, with CVSS 3.1 scores of 9.8 or 9.9. Oracle says 1,295 counts patches rather than unique CVEs and urges customers to patch quickly; unsupported releases were not tested.

Unconfirmed: The article does not say the newly addressed CVEs are being exploited; its attack warning refers to already available patches.

Key facts

CVE-2026-75803 scores 9.8 on Database Server releases 19.3–19.32 and 23.4.0–23.26.3.
APEX CVE-2026-101521 scores 9.8 on listed 24.1, 24.2 and 26.1 ranges; DOMPurify CVE-2026-66010 scores 6.1.
Essbase 21.8.3.0.0 has four CVSS 9.9 flaws plus unauthenticated CVE-2026-91665 at 9.8.
The same OpenSSL CVE-2026-75803 scores 9.1 on Autonomous Health Framework 26.3–26.8.

Security assessment · AI, from the article

Impact: Unauthenticated remote impact on confidentiality, integrity and availability

Product	Affected
Oracle Database Server	19.3–19.32 and 23.4.0–23.26.3
Oracle APEX	24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4
Oracle Essbase	21.8.3.0.0
Oracle Autonomous Health Framework	26.3–26.8

What to do

1.Apply the October 2026 Critical Patch Update as soon as possible.
2.Map deployed versions to Oracle’s affected-product tables and risk matrices.
3.Upgrade unsupported releases; blocking protocols or removing privileges does not fix the flaws.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-75803 CVE-2026-101521 CVE-2026-66010 CVE-2026-91637 CVE-2026-91638 CVE-2026-91658 CVE-2026-91663 CVE-2026-91665

ATT&CK: T1190 Exploit Public-Facing Application

Tags: oracle critical-patch-update openssl apex essbase mysql

Vendors: Oracle
Products: Oracle Database Server Oracle Fusion Middleware Oracle E-Business Suite Oracle APEX Oracle Essbase Oracle MySQL Oracle Java SE Oracle Autonomous Health Framework

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-101521	Missing authentication allows unauthenticated takeover of Oracle APEX	9.8	—		4d ago
CVE-2026-66010	DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes…	5.1	<1%	PoC	Jul 24, 2026
CVE-2026-75803	Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the…	9.1	<1%		Aug 25, 2026
CVE-2026-91637 +4 related CVEs CVE-2026-91638 CVE-2026-91658 CVE-2026-91663 CVE-2026-91665	Low-privilege access-control flaw in Oracle Essbase 21.8.3.0.0	9.9 group max	—		4d ago

From the original article

3 min read at gbhackers.com

Oracle has released its October 2026 Critical Patch Update, which includes 1,295 new security patches across its enterprise portfolio. Published on October 20, the advisory addresses vulnerabilities in Oracle software as well as third-party components. Notably, it addresses critical flaws that attackers can exploit remotely without authentication.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.