12 stories, newest first · one card per story
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
The October 20 notice names JD Edwards, MySQL, Java SE, WebLogic, PeopleSoft and many other lines, without CVE details.
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
Six hundred ninety patches are remotely exploitable without authentication, spanning database, middleware, Java and applications.
112 updates are critical; Fusion Middleware has 206 patches, 134 remotely exploitable without authentication.
Application Object Library 12.2.3 through 12.2.15 is fixed in Oracle's October 20, 2026 Critical Patch Update.
Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views