Oracle October 2026 CPU patches 1,295 flaws, six scored 10.0
October 23: CSO names six CVSS 10.0 unauthenticated takeover bugs in E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
Oracle’s October 20 Critical Patch Update fixes 1,295 issues, including six unauthenticated CVSS 10.0 flaws, with no confirmed exploitation.
Oracle published its October 2026 Critical Patch Update on October 20, listing 1,295 fixes across 33 product families. Tenable counts 1,209 unique CVEs because one flaw can appear in several matrices. CSO Online says six score CVSS 10.0 and allow unauthenticated takeover, including CVE-2026-101809 in E-Business Suite Workflow 12.2.3–12.2.15. Horizon3.ai says CVE-2026-101767, an unauthenticated Thin Client Framework SQL injection chainable to commands, was disclosed privately on July 24 and is not reported as exploited. Oracle says attacks continue against customers missing available patches. Tenable Blog rates updates 112 critical, 475 high, 613 medium and 95 low; SecurityWeek, citing Tenable, reports 95 critical, 439 high and 582 medium.
- Workflow, SOA Suite, Access Manager and JD Edwards Orchestrator have CVSS 10.0 bugs.
- CVE-2026-101767 affects Application Object Library 12.2.3 through 12.2.15; CVSS 9.8.
- Fusion Middleware has 206 patches, 134 remotely exploitable without authentication.
- E-Business Suite has 194 patches; 31 need no authentication, per Tenable.
- Oracle has not marked these October CPU flaws as exploited in the wild.
- Next full CPU is January 19, 2027; critical updates November 17 and December 15.
Timeline
dated events in the reporting · oldest first- Jul 24, 2026Horizon3 privately disclosed CVE-2026-101767 to Oracle. · Horizon3.ai
- Oct 20, 2026Oracle released the October 2026 Critical Patch Update. · Tenable Blog
What each outlet adds
beyond the shared facts- Horizon3.aiUnauthenticated TCF SQL injection details, default firewall exposure, and indicators.
- Tenable BlogUpdate severity split and unauthenticated counts by product family.
- Cyber Security NewsNames CVSS 9.8 Database OpenSSL and APEX flaws; cites Oracle on ongoing attacks.
- SecurityWeekDifferent Tenable severity totals, product fix counts, and later patch dates.
- CSO OnlineIdentifies all six CVSS 10.0 flaws and affected version ranges.
Coverage
oldest first · one row per article · UTC- · 5d ago
Horizon3.aiFirst report
Oracle EBS flaw CVE-2026-101767 allows unauthenticated SQLi and RCE
Application Object Library 12.2.3 through 12.2.15 is fixed in Oracle's October 20, 2026 Critical Patch Update.
- · 4d ago
Tenable Blog
Oracle October 2026 CPU fixes 1209 CVEs in 1295 patches
112 updates are critical; Fusion Middleware has 206 patches, 134 remotely exploitable without authentication.
- · 4d ago
Cyber Security News
Oracle October 2026 CPU fixes unauthenticated E-Business Suite takeover bug
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
- · 3d ago
SecurityWeek
Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
- · 2d ago
CSO Online
Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101521 | Missing authentication allows unauthenticated takeover of Oracle APEX | 9.8 | — | ||
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | — | ||
| CVE-2026-101809 | Unauthenticated Workflow takeover in Oracle E-Business Suite | 10.0 | — | ||
| CVE-2026-75803 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the… | 9.1 | <1% | ||
| CVE-2026-87337 | Unauthenticated data access and modification in Oracle Access Manager | 10.0 | — | ||
CVE-2026-91216+2 related CVEs | Unauthenticated takeover in Oracle SOA Suite Fabric Layer | 10.0 | — | ||
| CVE-2026-91299 | Unauthenticated takeover in JD Edwards EnterpriseOne Orchestrator | 10.0 | — | ||
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |