ORACLE’S Critical Patch Update for October 2026 has a large slate, delivering 1,295 security updates that fix 1,209 unique CVEs across 33 product families, from databases to retail and healthcare software. The update, released on 20 October 2026, includes six flaws rated CVSS 10.0 and a substantial number of patches that are remotely exploitable without authentication.
Among the highest-profile entries are CVE-2026-101809 in E-Business Suite (Workflow), CVE-2026-87337 in Oracle Access Manager, CVE-2026-91216 in Oracle SOA Suite, CVE-2026-91231 in Oracle SOA Suite, and CVE-2026-91299 in JD Edwards EnterpriseOne Orchestrator. The article notes that none of the top-tier flaws are confirmed as exploited in the wild to date.
The piece emphasises the practical risk profile: many of the critical bugs reside in internet-facing components such as WebLogic, SOA Suite, Access Manager, and E-Business Suite, which can expose payroll, supply chain, and identity data to unauthenticated attackers. Oracle’s risk matrices indicate several flaws offer unauthenticated remote access, with a number of patches tied to third-party libraries (OpenSSL, curl, Apache MINA, Spring).
Exploitation status remains unconfirmed, though past cycles show attackers frequently reverse-engineering patches quickly. The recommended response prioritises patching internet-facing systems first, addressing all remotely exploitable flaws before attending to internal systems, and reducing exposure in the interim by blocking relevant traffic and limiting public access to sensitive consoles. Full details are available in Oracle’s October 2026 advisory.