- Oracle's October 2026 update holds 1,295 new patches, and Oracle says 134 of the 206 in Fusion Middleware address flaws exploitable over a network without credentials.
- Applications such as E-Business Suite inherit fixes from the Database and Middleware beneath them, and Oracle patches only versions under Premier or Extended Support.
- Ask for an inventory of Oracle versions, their support status and which systems are reachable without a login.
A patch count measures Oracle's workload. It says little about your risk. Oracle says its October 2026 Critical Patch Update holds 1,295 new security patches. The useful question is how many of them apply to systems you run. A second question follows. Can your team tell?
What Oracle released
A Critical Patch Update is Oracle's scheduled bundle of security fixes. This one covers dozens of product families.
Tenable's analysis, reported by SecurityWeek, counts 1,209 unique CVEs. A CVE is the public ID number for a flaw. Tenable says 95 are critical, 439 are high and 582 are medium.
The patch count and the flaw count differ. Oracle explains why. A flaw that touches several products appears in each product's list.
SecurityWeek reports that Fusion Middleware got the most fixes, with 206. E-Business Suite follows with 194, and Siebel CRM with 122. Six more groups each received between 50 and 110. They include PeopleSoft, MySQL and Java SE.
SecurityWeek adds that Oracle has not flagged any of these flaws as exploited in the wild.
Why 'without authentication' is the phrase to watch
Oracle uses this phrase for flaws that can be exploited over a network without user credentials. An attacker does not need a stolen password to try.
Oracle's own counts show where these flaws cluster. In Fusion Middleware, 134 of 206 patches are in this group. That is about two in three.
In Java SE, the figure is 49 of 55. In Communications, it is 77 of 110. In Siebel CRM, it is 66 of 122. In E-Business Suite, it is 31 of 194.
Scores also depend on how software is run. Oracle's Java scores assume the user is an administrator. Oracle calls that typical on Windows. On Solaris and Linux, users usually are not administrators. There, the impact ratings drop from High to Low. Oracle's example is a 9.6 score that becomes 7.1.
Oracle does not share its detailed analysis of each flaw. It publishes a risk matrix instead. Customers use it to judge their own exposure.
Your applications inherit flaws from the layers below
Oracle says E-Business Suite and Enterprise Manager include Oracle Database and Fusion Middleware components. Fixes for those components are not in the applications' own risk matrices. Oracle tells customers to apply the October update to those components too.
This is the quiet trap. A team that reads only its application's list sees part of the picture. Exposure depends on the Database and Middleware versions underneath.
Oracle points to My Oracle Support note KA923 for E-Business Suite. For Enterprise Manager, it points to note CPU391.
Support status decides whether a fix exists
Oracle issues these patches only for versions under Premier Support or Extended Support. Older releases are not tested for these flaws. Oracle says earlier versions are likely affected too.
Oracle also says it keeps receiving reports of attacks on flaws it has already patched. In some cases, it says, attackers got in because customers had not applied available patches.
A system outside support may have no patch to apply at all.
Oracle names two stopgaps. One is blocking the network protocols an attack needs. The other is removing privileges users do not need. Both may break application functionality. Oracle says neither is a long-term solution.
What to ask your team this week
First, ask for a list of every Oracle product and version in use. Mark which ones are inside Premier or Extended Support.
Second, ask which applications sit on Oracle Database or Fusion Middleware. They inherit those fixes.
Third, ask which affected systems can be reached over a network without a login.
Then ask about timing. SecurityWeek reports that Oracle's next Critical Security Patch Updates arrive on November 17 and December 15. The next full update is due January 19, 2027.
SecurityWeek also reports a separate Oracle advisory for CVE-2026-91403. It is Java's response to the eMudhra weak-key incident. Ask whether your Java systems are covered.
Test changes on non-production systems first, as Oracle advises. A patch you cannot match to a system is a patch you cannot confirm. Oracle printed the number 1,295. The number that matters is the one in your own inventory.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Oracle.
