Oracle released its October 2026 Critical Patch Update on Oct 20 with 1,295 new security patches. In Oracle's risk matrices, 112 entries score CVSS 9.0 or higher. The largest families are Fusion Middleware (206 patches, 134 remotely exploitable without authentication), E-Business Suite (194, 31 unauthenticated remote), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98) and Java SE (55).

CVSS 10.0, remotely exploitable without credentials:

• CVE-2026-101809, E-Business Suite Workflow (Notification Mailer), over HTTP. EBS was mass-exploited by Cl0p in 2025, so internet-facing EBS should go first.
• CVE-2026-87337, Oracle Access Manager (Authentication Engine), over HTTP. This is the identity front door for many Oracle shops.
• CVE-2026-91231 (Adapters, HTTP) and CVE-2026-91216 / CVE-2026-91221 (Fabric Layer, T3/IIOP), all in Oracle SOA Suite.
• CVE-2026-91299, JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security), over HTTP.

Also notable: WebLogic Server CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3/IIOP), both 9.8 and unauthenticated; APEX CVE-2026-101521 (9.8); Secure Backup CVE-2026-101484 (9.8); and an OpenSSL fix in the Database RDBMS (CVE-2026-75803, 9.8). The advisory does not say any of these are being exploited.

Oracle's advisory now lists monthly security release dates on the third Tuesday: Critical Security Patch Updates (CSPU) on Nov 17 and Dec 15, 2026, and the next full CPU on Jan 19, 2027.

Do now: patch internet-facing EBS, Access Manager, WebLogic and SOA first. Block T3/IIOP at the perimeter, and make sure WebLogic consoles and EBS admin pages are not exposed to the internet.