Oracle October 2026 CPU and separate Java JSSE alert
October 21: CCCS issued AV26-1071 pointing to the CPU without CVE detail, and the Java alert lists affected builds, support-only patches, and no exploitation status.
Oracle’s October 2026 patch update spans many products, while a separate CVSS 9.1 Java alert states no exploitation status.
As of October 21, 2026, Oracle has an October Critical Patch Update covering many product lines and a separate security alert for CVE-2026-91403. The Canadian Centre for Cyber Security’s October 20 notice, AV26-1071, names JD Edwards, MySQL, Java SE, WebLogic, PeopleSoft, database, middleware, and other lines but gives no CVE identifiers, scores, or version ranges. Oracle’s October 21 alert covers CVE-2026-91403 in JSSE for listed Java SE, GraalVM for JDK, and GraalVM Enterprise builds, scored CVSS 3.1 9.1. It is remotely reachable without authentication, including through APIs and some sandboxed clients. The alert does not say whether the flaw is exploited and supplies patches only for Premier or Extended Support versions.
- CCCS serial AV26-1071, dated October 20, names many Oracle lines without CVEs.
- CVE-2026-91403 is CVSS 3.1 9.1 in JSSE and needs no privileges.
- Listed Java SE builds include 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1.
- GraalVM for JDK 17.0.21 and 21.0.13 and Enterprise Edition 21.3.20 are listed.
- Alert patches cover only Premier or Extended Support versions; no reporter is credited.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026CCCS publishes AV26-1071 on Oracle’s October CPU · Canadian Centre for Cyber Security
- Oct 21, 2026Oracle alert covers CVE-2026-91403 in Java JSSE · Hacker News
What each outlet adds
beyond the shared facts- Canadian Centre for Cyber SecurityNames the CPU’s product lines and gives no CVE details.
- Hacker NewsLists builds, CVSS 9.1 reachability, and support-only patches.
- CVEs
- CVE-2026-91403
Coverage
oldest first · one row per article · UTC- · 4d ago
Canadian Centre for Cyber SecurityFirst report
Oracle October 2026 CPU lists flaws across dozens of products
The October 20 notice names JD Edwards, MySQL, Java SE, WebLogic, PeopleSoft and many other lines, without CVE details.
- · 3d ago
Hacker News · security
Oracle alerts on unauthenticated Java JSSE flaw CVE-2026-91403
The CVSS 9.1 issue affects named Java SE and GraalVM builds and can be reached through JSSE APIs without credentials.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |