Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.

By

Eduard Kovacs

| October 22, 2026 (3:38 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products.

According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws.

Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity.

Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication.

A significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).

Oracle Essbase, REST Data Services, Analytics, Systems, Database Server, Construction and Engineering, Enterprise Manager, GoldenGate, Trusted Answer Search, Utilities Applications, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services Applications, Retail Applications, TimesTen In-Memory Database, Healthcare Applications, Hospitality Applications, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database, and SQL Developer also received patches.

Advertisement. Scroll to continue reading.

Oracle has not flagged any of these vulnerabilities as exploited in the wild, but the software giant has reminded customers that it periodically receives reports of exploitation attempts targeting its products.

On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, which is Java’s (and Oracle’s) response to the eMudhra weak-key incident.

Oracle will release Critical Security Patch Updates (CSPUs) on November 17 and December 15. These types of updates go out on the third Tuesday of every month. The next CPU is scheduled for January 19, 2027.

Related: Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

Related: Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Related: CISA Warns of Exploited Oracle WebLogic Vulnerability

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • Atlassian Patches 75 Flaws in Data Center and Server Products
  • Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
  • Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  • Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
  • OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
  • Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  • Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
  • Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring

Latest News

  • Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
  • In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
  • Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  • China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  • Attackers Exploit Third Arista VCO Zero-Day in Four Months
  • 11 Million Impacted by Capcom Data Breach
  • Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
  • LiteLLM Compromised in Fresh Supply Chain Attack

Trending

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Cequence Security has appointed Russ Schafer as CMO.

Mona Harrington has been named Assistant Director for Cyber Integration at DHS.

iCOUNTER has appointed Mark H. FitzPatrick as CFO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)

Begin at the End: How to Enable Agentic Remediation

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)