Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

What it is

Oracle's October 2026 Critical Patch Update (CPU) has 1,295 fixes. The page adds per-product patch counts, the dates of the next Oracle releases, and a caution about exploitation reports. The counts come from Tenable's analysis.

Affected

Patch counts by product family: Fusion Middleware 206 (134 remotely exploitable without authentication), E-Business Suite 194, Siebel CRM 122, Communications 110, PeopleSoft 109, JD Edwards 102, MySQL 98, Java SE 55 and Supply Chain 50.

Many smaller products also received patches:

• Data and database products: Essbase, REST Data Services, Database Server, GoldenGate, NoSQL Database, TimesTen In-Memory Database, APEX and SQL Developer.
• Management and tooling: Enterprise Manager, Application Testing Suite, Global Lifecycle Management, Autonomous Health Framework, Secure Backup and Virtualization.
• Industry applications: Financial Services, Retail, Healthcare, Hospitality, Utilities, Commerce, and Construction and Engineering.
• Others: Analytics, Systems and Trusted Answer Search.

An engineer can check an estate against this list to see which patch sets apply.

What to do

Plan around Oracle's stated schedule:

• Critical Security Patch Updates (CSPUs): 17 November 2026 and 15 December 2026.
• Next CPU: 19 January 2027.
• Separate Java alert: Oracle published an advisory and security alert for CVE-2026-91403 on Wednesday, one day after announcing the CPU. The page describes it as Java's and Oracle's response to the eMudhra weak-key incident. It is not part of the CPU counts, so it needs its own review wherever Java is deployed.

Caveats

Oracle has not flagged any of these vulnerabilities as exploited in the wild. It did remind customers that it periodically receives reports of exploitation attempts against its products. The page gives no CVSS scores, CVE identifiers or exploit details for individual flaws in the CPU, and it does not say which patches are most urgent.