Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products.
According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws.
Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity.
Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication.
A significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).
Oracle Essbase, REST Data Services, Analytics, Systems, Database Server, Construction and Engineering, Enterprise Manager, GoldenGate, Trusted Answer Search, Utilities Applications, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services Applications, Retail Applications, TimesTen In-Memory Database, Healthcare Applications, Hospitality Applications, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database, and SQL Developer also received patches.
Oracle has not flagged any of these vulnerabilities as exploited in the wild, but the software giant has reminded customers that it periodically receives reports of exploitation attempts targeting its products.
On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, which is Java’s (and Oracle’s) response to the eMudhra weak-key incident.
Oracle will release Critical Security Patch Updates (CSPUs) on November 17 and December 15. These types of updates go out on the third Tuesday of every month. The next CPU is scheduled for January 19, 2027.
Related: Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
Related: Oracle Patches 800+ Vulnerabilities in September 2026 Security Update
Related: CISA Warns of Exploited Oracle WebLogic Vulnerability
