Oracle’s October CPU Fixes 1,209 CVEs

Oracle released its October 2026 Critical Patch Update on Oct. 20, following its quarterly security update schedule. The update covers 1,295 fixes linked to 1,209 unique Common Vulnerabilities and Exposures (CVEs).

An analysis by Tenable found that 439 of the CVEs were rated high severity and 582 were rated medium severity. The update includes 95 critical-severity vulnerabilities.

Oracle Fusion Middleware received 206 fixes, the largest number for any product group. Of those vulnerabilities, 134 can be exploited remotely without authentication. Other products with large numbers of fixes include E-Business Suite with 194, Siebel CRM with 122, Communications with 110, PeopleSoft with 109, JD Edwards with 102 and MySQL with 98.

Oracle also released patches for Java SE, Supply Chain, Essbase, REST Data Services, Analytics, Systems, Database Server, Construction and Engineering, Enterprise Manager, GoldenGate, Utilities Applications, Virtualization, Autonomous Health Framework, Financial Services Applications, Retail Applications, Healthcare Applications, Commerce and APEX. Additional updates covered Trusted Answer Search, Secure Backup, TimesTen In-Memory Database, Hospitality Applications, Application Testing Suite, Global Lifecycle Management, NoSQL Database and SQL Developer.

Oracle has not identified any vulnerabilities in the October update as being exploited in the wild. The company said it periodically receives reports of attempted attacks targeting its products.

On Oct. 21, Oracle published a separate advisory and security alert for CVE-2026-91403. The alert concerns Java and Oracle’s response to the eMudhra weak-key incident.

Oracle’s next Critical Security Patch Updates are scheduled for Nov. 17 and Dec. 15, both on the third Tuesday of the month. The next quarterly Critical Patch Update is scheduled for Jan. 19, 2027.