Oracle October 2026 Critical Patch Update: What to Patch First

Oracle’s October 2026 Critical Patch Update, released on 20 October 2026, carries 1295 new security patches. Counting the rows of Oracle’s risk matrices, 590 of them are marked as remotely exploitable without authentication, and 112 score 9.0 or higher on CVSS 3.1. Six score the maximum of 10.0. This post lists where to start.

Oracle’s advisory does not say that any of these flaws is being exploited. We also checked the CISA Known Exploited Vulnerabilities catalog on 21 October 2026, and none of the new CVE ids in Oracle’s risk matrices is listed. A few older third-party flaws that the patches also fix, such as CVE-2025-24813 in Apache Tomcat, are in the catalog. That can change quickly, and Oracle itself warns that attackers go after flaws it has already patched.

On 28 October SecurityWeek reported probing of one of these flaws, CVE-2026-101767 in E-Business Suite; our Oracle EBS vulnerability post has the details.

• 1295New security patches in the updateSource: Oracle Critical Patch Update Advisory, October 2026
• 590Patches marked remotely exploitable without authenticationSource: Oracle Critical Patch Update Advisory, October 2026
• 112Patches with a CVSS 3.1 base score of 9.0 or higherSource: Oracle Critical Patch Update Advisory, October 2026
• 6Patches with the maximum score of 10.0Source: Oracle Critical Patch Update Advisory, October 2026

Which Products Carry the Most Unauthenticated Flaws?

Oracle’s text for each product family says how many of its patches can be exploited over a network without credentials. Fusion Middleware leads by a wide margin.

• Fusion Middleware: 134 of 206 patches. This family includes WebLogic Server, SOA Suite and Access Manager.
• Oracle Communications: 77 of 110.
• Siebel CRM: 66 of 122.
• Java SE: 49 of 55.
• JD Edwards: 44 of 102.
• PeopleSoft: 41 of 109. The exploited PeopleTools flaw CVE-2026-35273 was fixed in a separate June Security Alert and is not in this count.
• E-Business Suite: 31 of 194.
• MySQL: 29 of 98.

The raw counts are a poor guide to what to patch first. Oracle’s flag only says a flaw can be reached over a network without a login. It does not say the product sits on the internet. A flaw in a back-office server and one on a public web tier are very different problems, even when both carry the same flag. The CVSS score and the way the product is deployed matter more.

Which October Flaws Score Highest?

The table shows a selection of the most serious flaws Oracle marks as remotely exploitable without authentication. We chose products that commonly face the internet or sit in front of other systems. Oracle’s risk matrices list more flaws at 9.8 in the same products, among them a second Access Manager flaw (CVE-2026-87251). Scores and protocols come from those matrices. The order is our reading of them, not an Oracle ranking.

Oracle describes each of the 10.0 flaws as easily exploitable by an unauthenticated attacker with network access. For the Workflow, Access Manager, SOA Suite and JD Edwards entries it adds that the attack may significantly affect other products (scope change). For the E-Business Suite, SOA Suite and JD Edwards entries, a successful attack results in takeover of the product. The advisory gives no more technical detail than that.

In What Order Should You Patch?

1. E-Business Suite 12.2CVE-2026-101809 and CVE-2026-101767. We put it first because of CVE-2025-61882, an exploited 2025 flaw in the same product (Oracle Security Alert; CISA KEV).
2. Access Manager, WebLogic and SOA Suite over HTTPCVE-2026-87337, CVE-2026-91231 and CVE-2026-91323. Access Manager sits in front of other logins.
3. WebLogic and SOA Suite over T3 and IIOPCVE-2026-83399, CVE-2026-91216 and CVE-2026-91221. Check whether those ports are reachable from outside.
4. JD Edwards EnterpriseOne OrchestratorCVE-2026-91299. Patch it if the Orchestrator is enabled.
5. Unified Assurance, Database, APEX and MySQLStart with the internet-facing instances, then the rest.

E-Business Suite goes first because of its recent history. Oracle’s Security Alert for CVE-2025-61882 described a flaw in that product as remotely exploitable without authentication and possibly leading to remote code execution. CISA added it to the Known Exploited Vulnerabilities catalog on 6 October 2025 and lists its use in ransomware campaigns as known. Our CVE-2025-61882 page and the NVD record have the details. The October 2026 flaws are different bugs, and nothing says they are exploited. The product and the kind of flaw are the same, so we would not wait.

Identity and middleware come next. Oracle marks the Access Manager flaw as a scope change: an attack may significantly affect other products, not only Access Manager. The WebLogic and SOA Suite flaws that use T3 and IIOP need those ports to be reachable. Many teams do not need them open to the internet, so check your firewall rules first. A closed port reduces exposure, but the patch is still the fix.

External Attack Surface ManagementFind which of your Oracle systems answer from the internet, so you know what to patch first.See How It Works →

How Do You Know What Is Exposed?

Start with an inventory of every Oracle product you run and the version of each. The affected version ranges in the table are exact, so compare them with yours. Then find out which of these systems answer from the internet. Public hostnames, forgotten test servers and partner access points are the usual gaps. Our EASM 101 guide explains how to build that list.

After that, rank the open items by score, by exposure and by what the system holds. Our post on CVSS, EPSS and CISA KEV signals shows how to combine them. The CVSS glossary entry explains what the scores in the table mean.

Is There an Extra Java Alert After the Update?

Yes. On 21 October 2026, a day after the Critical Patch Update, Oracle published a separate Security Alert for CVE-2026-91403. It is a CVSS 9.1 flaw in the JSSE component of Java SE and GraalVM that an unauthenticated attacker can reach over the network.

Oracle lists Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 as affected, so check your Java builds against that list. The alert does not say the flaw is exploited. Our CVE-2026-91403 page has the affected versions and what to do.

What About Patches That Come Later?

Oracle publishes the next four dates in the advisory. Critical Security Patch Updates come on 17 November 2026, 15 December 2026 and 16 February 2027. The next full Critical Patch Update is on 19 January 2027. Oracle also says patches are provided only for versions under Premier or Extended Support. If you run an older release, the fix for you is an upgrade. Our patch management entry covers the wider process.