Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Oracle's October 2026 CPU includes fixes for 1,295 vulnerabilities spanning dozens of products. Of these, 1,209 are unique CVEs with 95 critical severity flaws, 439 high severity, and 582 medium severity. Fusion Middleware had 206 fixes, 134 of which can be exploited remotely without authentication. Other heavily patched products include E-Business Suite, Siebel CRM, Communications, PeopleSoft, JD Edwards, MySQL, and Java SE. Oracle has not reported any confirmed exploitation in the wild but acknowledges periodic exploitation attempts. The company also released a separate advisory for CVE-2026-91403 related to a Java weak-key incident. Oracle schedules monthly Critical Security Patch Updates (CSPUs) to continue addressing vulnerabilities.

The update addresses a large volume of vulnerabilities, including many critical and remotely exploitable flaws, particularly in Oracle Fusion Middleware and other widely used Oracle products. While no exploitation in the wild has been confirmed, the presence of remotely exploitable vulnerabilities without authentication indicates a significant risk if unpatched. The broad scope of affected products means that many Oracle customers could be impacted if they do not apply these patches promptly.

Oracle has released an official fix in the form of the October 2026 Critical Patch Update covering all identified vulnerabilities. Customers should apply this CPU promptly to mitigate risks. Oracle also provides ongoing monthly Critical Security Patch Updates, with the next releases scheduled for November 17 and December 15, 2026. No additional immediate actions beyond patching are indicated by Oracle.