ORACLE has issued its October 2026 Critical Patch Update for Oracle Fusion Middleware, patching a total of 203 vulnerabilities across three products. Four of the flaws are CVSS 10.0 criticals, with 131 patches exploitable remotely without authentication. The most at-risk products are Oracle SOA Suite, WebLogic Server and Oracle Access Manager. The four CVSS 10.0 flaws are CVE-2026-87337 (Oracle Access Manager), and CVE-2026-91216, CVE-2026-91221, CVE-2026-91231 (SOA Suite Fabric Layer and Adapters).
A fifth case, CVE-2026-83399, scores 9.8 and affects WebLogic Core, with another high-severity WebLogic issue noted, CVE-2026-91323, also presenting a CVSS 9.8 risk over HTTP. Oracle states there is no confirmed in-the-wild exploitation yet for these flaws.
The affected versions include Oracle SOA Suite (12.2.1[.]4.0 and 14.1.2[.]0.0), Oracle WebLogic Server (12.2.1[.]4.0, 14.1.1[.]0.0, 14.1.2[.]0.0, 15.1.1[.]0.0) and Oracle Access Manager (12.2.1[.]4.0 and 14.1.2[.]1.0). Oracle’s risk matrix also notes that Fusion Middleware remains a top priority due to its role as the glue layer for business workflows, SSO and web applications.
Practical response emphasises applying the October patches to all Fusion Middleware components, prioritising Access Manager, SOA Suite and WebLogic Server first. If immediate patching isn’t possible, the guidance includes blocking T3/IIOP from untrusted networks, removing admin consoles and public access to SOA endpoints, and tightening network controls around Access Manager while monitoring logs for unusual authentication activity. Oracle’s advisory provides the full remediation details.