Oracle's October patch: 1,295 fixes, and E-Business Suite goes first

Oracle shipped its October 2026 Critical Patch Update on October 20, with 1,295 new security patches. Tenable counts 1,209 unique CVEs behind them, and 112 of the patches are rated critical. Daily CyberSecurity counts six flaws with the maximum CVSS score of 10.0, in E-Business Suite, Access Manager, SOA Suite and JD Edwards.

No flaw in the release is known to be exploited. Daily CyberSecurity reports that Oracle's risk matrices flag none as exploited in the wild, and the E-Business Suite bug below is not in CISA's Known Exploited Vulnerabilities catalog. That is the window to use. Oracle's own advisory says some attacks on its products have worked because customers "had failed to apply" patches that were already out, and Daily CyberSecurity points to CVE-2025-61882, an E-Business Suite flaw used in a data theft and extortion campaign.

Where the patches are

Oracle's public advisory page has full detail for its database products. Per-family detail for E-Business Suite, Fusion Middleware, Java SE, MySQL and PeopleSoft sits in My Oracle Support documents that need a support login. The counts below for those families are Tenable's:

Daily CyberSecurity puts Fusion Middleware slightly lower, at 203 patches and 131 open to unauthenticated attack. Either way, Fusion Middleware has the most flaws an attacker can reach without a password.

Patch first: internet-facing E-Business Suite

Horizon3.ai published details on October 20 of CVE-2026-101767, a 9.8-rated SQL injection in the Application Object Library of E-Business Suite 12.2.3 through 12.2.15. An attacker with network access and no account sends requests to /OA_HTML/AppsTCFServer and runs SQL as the APPS database user. Horizon3 says that gives read and write access to financial, payroll, HR and procurement data, and can be chained to run operating system commands as the E-Business Suite application account.

The endpoint is allowed through the default E-Business Suite URL firewall configuration, so a standard install that faces the internet is exposed. Horizon3 reported the bug to Oracle on July 24. Its write-up includes indicators of compromise but does not claim attacks.

Until the patch is in, Horizon3 suggests removing /OA_HTML/AppsTCFServer from the URL firewall allowlist, limiting the web tier to trusted networks and watching the application host and database. It says these steps cut exposure and do not replace the patch. Patch applicability is in My Oracle Support note KA923.

The release also carries a 10.0 flaw in the E-Business Suite Workflow Notification Mailer, CVE-2026-101809, reachable over HTTP, according to Daily CyberSecurity.

Then: middleware and identity

Daily CyberSecurity lists the other 10.0 flaws:

• CVE-2026-87337 in the Oracle Access Manager authentication engine, over HTTP.
• CVE-2026-91216 and CVE-2026-91221 in the SOA Suite fabric layer, over T3 and IIOP.
• CVE-2026-91231 in SOA Suite adapters, over HTTP.
• CVE-2026-91299 in the JD Edwards EnterpriseOne Orchestrator, over HTTP.

It adds two 9.8 flaws in the WebLogic Server core, CVE-2026-83399 over T3 and IIOP and CVE-2026-91323 over HTTP. Its advice is to start with internet-facing systems running WebLogic, SOA Suite, E-Business Suite or Access Manager, and to block T3 and IIOP from untrusted networks where patching has to wait. Oracle's advisory also says blocking the protocols an attack needs can reduce risk until patches are applied, and that this is not a long-term fix.

Database products

These are on Oracle's public pages, with version ranges:

• Database Server: 14 patches, four open to unauthenticated attack. The highest-rated is CVE-2026-75803, a 9.8 OpenSSL flaw in the RDBMS reachable over TLS, in versions 19.3 to 19.32 and 23.4.0 to 23.26.3.
• APEX: two patches, both open to unauthenticated attack. CVE-2026-101521 is rated 9.8 and covers 24.1.0 to 24.1.21, 24.2.0 to 24.2.20 and 26.1.0 to 26.1.4.
• Essbase: 38 patches, 14 open to unauthenticated attack, with a top score of 9.9. CVE-2026-91665 in Essbase 21.8.3.0.0 is rated 9.8.
• Secure Backup: CVE-2026-101484, rated 9.8, in versions 19.1.0.0.0 and 19.1.0.1.0.
• REST Data Services: 35 patches, 11 open to unauthenticated attack.

Oracle does not test releases outside Premier or Extended Support for these flaws. So a database on an unsupported release may carry these flaws without Oracle saying so.

Oracle wants a monthly cycle

Tenable calls the October release the final quarterly update of 2026. Oracle's security blog asks customers to move to monthly patching starting with this one. Its security updates now ship on the third Tuesday of every month. The next dates on the advisory are November 17 and December 15, both Critical Security Patch Updates, then the next full Critical Patch Update on January 19, 2027.

The monthly releases are not small. Mallory counts 943 patches in the August update and 673 in September. Add October's 1,295 and Oracle has shipped 2,911 patches in three months. A team that tests Oracle patches once a quarter will start November behind.

Oracle's pre-release notice also differed from the final release. About InfoSec, writing from the pre-release notice, listed 1,283 patches and 196 for E-Business Suite. Plan from the final advisory, not the preview.