---
title: Oracle October 2026 Critical Patch Update: 1,295 patches, six rated CVSS 10.0 (EBS Workflow Notification Mailer, Access Manager, SOA Suite, JD Edwards Orchestrator), plus WebLogic 9.8s | ctxsec
url: https://ctxsec.com/items/oracle-cpu-oct-2026
description: "Oracle's Oct 20, 2026 CPU ships 1,295 new security patches, 112 of them scored CVSS 9.0 or higher, including unauthenticated network-reachable 10.0s in E-Business Suite Workflow, Oracle Access Manager, SOA Suite and JD Edwards EnterpriseOne Orchestrator."
status: "confirmed (Oracle CPU advisory, Oct 20); no exploitation noted by Oracle"
published: 2026-10-20
---

> Oracle's Oct 20, 2026 CPU ships 1,295 new security patches, 112 of them scored CVSS 9.0 or higher, including unauthenticated network-reachable 10.0s in E-Business Suite Workflow, Oracle Access Manager, SOA Suite and JD Edwards EnterpriseOne Orchestrator.

[← Cybersecurity News](/news) · [markdown](/items/oracle-cpu-oct-2026.md)

confirmed (Oracle CPU advisory, Oct 20); no exploitation noted by Oracle

2026-10-20

### Oracle October 2026 Critical Patch Update: 1,295 patches, six rated CVSS 10.0 (EBS Workflow Notification Mailer, Access Manager, SOA Suite, JD Edwards Orchestrator), plus WebLogic 9.8s

Oracle released its [October 2026 Critical Patch Update](https://www.oracle.com/security-alerts/cpuoct2026.html) on **Oct 20** with **1,295 new security patches**. In Oracle's risk matrices, 112 entries score CVSS 9.0 or higher. The largest families are Fusion Middleware (206 patches, 134 remotely exploitable without authentication), E-Business Suite (194, 31 unauthenticated remote), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98) and Java SE (55).

**CVSS 10.0, remotely exploitable without credentials:**

- **CVE-2026-101809**, E-Business Suite Workflow (Notification Mailer), over HTTP. EBS was mass-exploited by Cl0p in 2025, so internet-facing EBS should go first.
- **CVE-2026-87337**, Oracle Access Manager (Authentication Engine), over HTTP. This is the identity front door for many Oracle shops.
- **CVE-2026-91231** (Adapters, HTTP) and **CVE-2026-91216** / **CVE-2026-91221** (Fabric Layer, T3/IIOP), all in Oracle SOA Suite.
- **CVE-2026-91299**, JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security), over HTTP.

Also notable: WebLogic Server **CVE-2026-91323** (HTTP) and **CVE-2026-83399** (T3/IIOP), both 9.8 and unauthenticated; APEX **CVE-2026-101521** (9.8); Secure Backup **CVE-2026-101484** (9.8); and an OpenSSL fix in the Database RDBMS (**CVE-2026-75803**, 9.8). The advisory does not say any of these are being exploited.

Oracle's advisory now lists monthly security release dates on the third Tuesday: Critical Security Patch Updates (CSPU) on **Nov 17** and **Dec 15, 2026**, and the next full CPU on **Jan 19, 2027**.

**Do now:** patch internet-facing EBS, Access Manager, WebLogic and SOA first. Block T3/IIOP at the perimeter, and make sure WebLogic consoles and EBS admin pages are not exposed to the internet.

Sources: [Oracle Critical Patch Update Advisory - October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)