VulnerabilitiesOct 22, 2026

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Oracle released October 2026 CPU with 1,295 fixes, including 95 critical flaws.

Oracle's October 2026 Critical Patch Update (CPU) addresses 1,295 new vulnerabilities across numerous products, with 95 of these rated as critical severity. Oracle Fusion Middleware received the largest number of fixes, including 134 remote exploitable flaws without authentication. While Oracle has not confirmed any of these vulnerabilities are being actively exploited in the wild, they remind customers of potential exploitation attempts.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Oracle?

Get an email when a new story names Oracle, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Oracle's October 2026 Critical Patch Update exposes the sheer scale of vulnerability debt that can accumulate across enterprise software ecosystems, with 1,295 new flaws including 95 critical-severity issues. Most alarming is that Oracle Fusion Middleware alone carries 134 remotely exploitable vulnerabilities requiring no authentication — meaning attackers need only network access to potentially compromise systems. Organizations running unpatched Oracle products represent high-value, low-effort targets, as threat actors routinely reverse-engineer CPU patches to develop exploits within days of release. This incident reinforces that delayed patching of widely deployed enterprise middleware is one of the highest-risk postures an organization can maintain.

What helps against this

How we list vendors

Oracle affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleHolm Security Platform Tenable Vulnerability Management Rapid7 Exposure Command (InsightVM)all options
Automated patch management
Known holes get closed in days, not months.
For exampleNinjaOne Patch Management Microsoft Intune Qualys Patch Management all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDefused TF Google Threat Intelligence Dataminr Threat Intelligence all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-91403

Entities

Oracle (vendor)Fusion Middleware (product)E-Business Suite (product)Siebel CRM (product)Java SE (product)MySQL (product)