Oracle October 2026 Update Fixes 1,209 Flaws: What to Patch First

admin — Wed, 21 Oct 2026 12:32:14 +0000

Oracle released its October 2026 Critical Patch Update on Tuesday, 20 October, and it is a very large one. It matters to any organisation that runs Oracle software, from large enterprises using E-Business Suite or WebLogic to small development teams that simply have Java or MySQL somewhere in their stack. This article explains what was fixed, which systems to patch first, and how smaller IT teams can approach a release of this size without getting overwhelmed.

Key takeaways

The update contains 1,295 security patches addressing 1,209 unique CVEs across 33 Oracle product families.
According to Tenable’s analysis, 95 CVEs are rated critical and 439 are rated high.
Hundreds of the fixes address flaws that can be exploited remotely without a username or password.
Several flaws in Oracle Fusion Middleware, E-Business Suite and JD Edwards carry the maximum CVSS v3 score of 10.0.
Oracle’s risk matrices do not flag any of the flaws as exploited in the wild, but attackers often study patches quickly, so delay is risky.

Photo: “Mediq Utrecht Data center Gwan Kho” by Gwan Kho, CC BY-SA 2.0, via Openverse

What Oracle released

Oracle’s quarterly Critical Patch Update (CPU) is its main vehicle for security fixes. The October 2026 edition, the last quarterly CPU of the year, covers 33 product families, including Oracle Database Server, Java SE, MySQL, E-Business Suite, Fusion Middleware, Enterprise Manager, PeopleSoft and Siebel CRM.

Tenable’s breakdown, published via Security Boulevard, puts the severity split at 95 critical CVEs, 439 high, 582 medium and 93 low. In patch terms, critical fixes make up just under 9 percent of the total, while high-severity fixes account for more than a third.

Where the fixes are concentrated

Two product families take the largest share. Oracle Fusion Middleware, which includes WebLogic Server, SOA Suite and Access Manager, received roughly 200 patches, and E-Business Suite received 194. Other heavily patched families include:

Siebel CRM, with 122 patches
Oracle Communications, with 110 patches
PeopleSoft, with 109 patches
JD Edwards, with 102 patches
MySQL, with 98 patches
Java SE, with 55 patches, most of which are remotely exploitable without authentication

Oracle Database Server received a much smaller set of 13 patches, one of them rated critical.

The most serious flaws

SecurityOnline’s analysis highlights a group of flaws rated 10.0, including issues in the E-Business Suite Workflow Notification Mailer, the Access Manager authentication engine, SOA Suite components and the JD Edwards EnterpriseOne Orchestrator. Several WebLogic Server core flaws are rated 9.8, some reachable over the T3 and IIOP protocols and others over plain HTTP. A 9.8-rated issue in Database Server relates to its bundled OpenSSL component, and Oracle APEX also has a 9.8-rated fix.

The common thread is that many of these flaws are reachable over the network and, in a number of cases, need no login. That is exactly the profile attackers look for in internet-facing business systems.

Why this matters even without known attacks

Oracle’s advisories do not report active exploitation for this batch, and no public proof-of-concept had been confirmed when analysts wrote about the release. That is good news, but it is not a reason to wait. Analysts warn that attackers often reverse-engineer Oracle patches within days of release. SecurityOnline also recalls CVE-2025-61882, an E-Business Suite flaw abused in a 2025 data theft and extortion campaign, as a reminder of how valuable these systems are to criminals.

For Nigerian and African organisations, this is not a distant problem. Oracle ERP, database and middleware products run in many large organisations across the region, and many mid-sized companies use Java-based or MySQL-backed applications built by local vendors. Systems that hold payroll, customer and financial data are prime targets for extortion.

How to prioritise a release this big

No team can apply 1,295 patches at once. A sensible order, based on analysts’ recommendations, looks like this:

Internet-facing middleware and ERP first. Patch WebLogic, SOA Suite, Access Manager and E-Business Suite servers that are reachable from the internet.
Remote, no-login flaws next. Work through every remaining fix that Oracle’s risk matrices mark as remotely exploitable without authentication.
Internal systems in the next maintenance window. Database Server, MySQL and Java SE installations that are not directly exposed can follow, but should not be left for months.

If you cannot patch immediately

Block T3 and IIOP traffic from untrusted networks, since several WebLogic and SOA Suite flaws use those protocols.
Keep E-Business Suite and middleware administration consoles off the public internet; put them behind a VPN or restrict them to known IP addresses.
Increase monitoring of logs on exposed Oracle systems until patches are in place.

Don’t forget the hidden Oracle software

Smaller organisations often do not think of themselves as “Oracle customers”, yet Java runtimes and MySQL databases sit inside many line-of-business applications, accounting tools and websites. Ask your software vendors whether their products bundle Java or MySQL and when they will ship updated builds.

Oracle’s move towards more frequent patching

Alongside the quarterly CPU, Oracle has been publishing monthly Critical Security Patch Update advisories in recent months, and its October announcement encourages customers to adopt a monthly security patching cycle. For many teams that will mean changing how they schedule maintenance windows and test updates. It is worth starting that conversation now rather than when the next large release arrives.

What you should do

Identify every Oracle product you run, including Java and MySQL embedded in third-party applications.
Read Oracle’s October 2026 advisory and its risk matrices for the products you use.
Patch internet-facing WebLogic, SOA Suite, Access Manager and E-Business Suite systems first.
Apply temporary network restrictions where patching must wait.
Review your patch process so you can handle Oracle’s monthly security updates in future.

Sources

Featured image: Photo: “17° Server Room @ Work” by Leonardo Rizzi, CC BY-SA 2.0, via Openverse — source

Java – Mosravo Endless Solutions Publications