/
← Voltar ao feed
high

Oracle October 2026 CPU: 1,295 patches for 1,209 CVEs, with unauthenticated CVSS 9.8–9.9 flaws in Database, APEX and Essbase

2 fonte(s) · 2 atualização(ões) · publicado 20/10/2026 18:58 · coletado há 19 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:10; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ tenable.com ↗

Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It delivers 1,295 security patches for 1,209 unique CVEs across 33 product families (tenable.com). The patch count is higher than the CVE count because one CVE can appear in several product matrices (gbhackers.com). 112 patches (8.6%) are rated critical and cover 95 CVEs (tenable.com). Several fixes address flaws that can be exploited remotely without authentication in databases, middleware, business applications, Java, MySQL and virtualization platforms (gbhackers.com). Neither source names any CVE as exploited in the wild. Oracle warned that attackers keep targeting vulnerabilities that already have patches, and that some successful attacks happened because customers had not applied fixes (gbhackers.com).

Detalhes técnicos

  • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93 (tenable.com).
  • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite has 194 (15%), 31 without authentication (tenable.com).
  • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98) (tenable.com).
  • CVE-2026-75803: OpenSSL component in Oracle Database Server, CVSS 3.1 9.8, exploitable unauthenticated over TLS with no user interaction. Affects 19.3–19.32 and 23.4.0–23.26.3. The same CVE is rated 9.1 in Oracle Autonomous Health Framework (versions 26.3–26.8) (gbhackers.com).
  • CVE-2026-101521: Oracle APEX General component, CVSS 9.8, unauthenticated network exploitation over HTTPS with low complexity. Affects 24.1.0–24.1.21, 24.2.0–24.2.20 and 26.1.0–26.1.4 (gbhackers.com).
  • CVE-2026-66010: DOMPurify component bundled with APEX, CVSS 6.1, requires user interaction (gbhackers.com).
  • Oracle Essbase has 38 patches, 14 of them remotely exploitable without authentication. CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663 score 9.9 on version 21.8.3.0.0. They need low privileges and no user interaction, via HTTP or T3/IIOP. CVE-2026-91665 scores 9.8 and is unauthenticated over TCP (gbhackers.com).
  • Oracle Database Products received 126 patches. The Database Server accounts for 14, four of them remotely exploitable without authentication (gbhackers.com).
  • Tenable's article does not list individual CVE identifiers (tenable.com).

Remediação

  • Apply the October 2026 CPU as soon as possible. Map deployed versions against Oracle's affected product tables and risk matrices (gbhackers.com, tenable.com).
  • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws (tenable.com).
  • Temporary mitigations include blocking the protocols needed for exploitation and removing unnecessary privileges and package access. These may break applications, need testing outside production, and do not fix the underlying flaws (gbhackers.com).
  • Review earlier advisories if prior updates were skipped (gbhackers.com).
  • Upgrade unsupported releases, which are not tested for these flaws and may still be affected (gbhackers.com).
  • Consult the Oracle advisory, risk matrices and advisory-to-CVE map. Tenable detection plugins will be published as they are released (tenable.com).

Linha do tempo

  1. gbhackers.com ↗ · pub. 21/10/2026 06:18 · coletado 21/10 08:00

    Oracle October 2026 CPU ships 1,295 patches, including multiple unauthenticated CVSS 9.8–9.9 flaws in Database, APEX and Essbase

    ler a análise desta fonte

    Oracle published its October 2026 Critical Patch Update on October 20, delivering 1,295 security patches across Oracle software and third-party components. Several fixes address critical flaws that can be exploited remotely without authentication, affecting databases, middleware, business applications, Java, MySQL and virtualization platforms. Oracle warned that attackers keep trying to exploit vulnerabilities that already have patches, and that some successful attacks occurred because customers had not applied fixes. The article does not name any specific CVE as exploited in the wild. The 1,295 figure counts patches, not unique vulnerabilities, since one CVE can appear in multiple product matrices.

    Technical Details

    • CVE-2026-75803: OpenSSL component in Oracle Database Server, CVSS 3.1 9.8, exploitable unauthenticated over TLS with no user interaction. Affects 19.3–19.32 and 23.4.0–23.26.3. The same CVE is rated 9.1 in Oracle Autonomous Health Framework (versions 26.3–26.8).
    • CVE-2026-101521: Oracle APEX General component, CVSS 9.8, unauthenticated network exploitation over HTTPS with low complexity. Affects 24.1.0–24.1.21, 24.2.0–24.2.20 and 26.1.0–26.1.4.
    • CVE-2026-66010: DOMPurify component bundled with APEX, CVSS 6.1, requires user interaction.
    • Oracle Essbase (38 patches, 14 remotely exploitable without authentication): CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663 score 9.9 on version 21.8.3.0.0. They need low privileges and no user interaction, via HTTP or T3/IIOP. CVE-2026-91665 scores 9.8 and is unauthenticated over TCP.
    • Oracle Database Products received 126 patches. The Database Server accounts for 14 of them, four of which are remotely exploitable without authentication.

    Remediation

    • Apply the October 2026 CPU as soon as possible, mapping deployed versions against Oracle's affected product tables and risk matrices.
    • Temporary mitigations include blocking the protocols needed for exploitation and removing unnecessary privileges and package access. These may break applications, need testing outside production, and do not fix the underlying flaws.
    • Review earlier advisories if prior updates were skipped.
    • Upgrade unsupported releases, which are not tested for these flaws and may still be affected.
  2. tenable.com ↗ · pub. 20/10/2026 18:58 · coletado 20/10 20:00 primeiro registro

    Oracle October 2026 CPU fixes 1,209 CVEs in 1,295 patches, including 112 critical updates

    ler a análise desta fonte

    Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It fixes 1209 unique CVEs in 1295 security updates across 33 product families. 112 of the patches (8.6%) are rated critical and cover 95 CVEs. The article does not mention exploitation in the wild.

    Technical Details

    • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93.
    • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite follows with 194 (15%), 31 without authentication.
    • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98).
    • The article does not list individual CVE identifiers.

    Remediation

    • Apply all relevant patches from the October 2026 CPU.
    • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws.
    • Consult the Oracle advisory, risk matrices and advisory-to-CVE map for details. Tenable plugins for detection will be published as they are released.