/
← Voltar ao feed
high

Oracle October 2026 CPU fixes 1,209 CVEs in 1,295 patches, including 112 critical updates

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 18:58 · coletado há 1 hora

Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It fixes 1209 unique CVEs in 1295 security updates across 33 product families. 112 of the patches (8.6%) are rated critical and cover 95 CVEs. The article does not mention exploitation in the wild.

Technical Details

  • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93.
  • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite follows with 194 (15%), 31 without authentication.
  • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98).
  • The article does not list individual CVE identifiers.

Remediation

  • Apply all relevant patches from the October 2026 CPU.
  • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws.
  • Consult the Oracle advisory, risk matrices and advisory-to-CVE map for details. Tenable plugins for detection will be published as they are released.

Linha do tempo

  1. tenable.com ↗ · pub. 20/10/2026 18:58 · coletado 20/10 20:00 primeiro registro

    Oracle October 2026 CPU fixes 1,209 CVEs in 1,295 patches, including 112 critical updates

    ler a análise desta fonte

    Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It fixes 1209 unique CVEs in 1295 security updates across 33 product families. 112 of the patches (8.6%) are rated critical and cover 95 CVEs. The article does not mention exploitation in the wild.

    Technical Details

    • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93.
    • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite follows with 194 (15%), 31 without authentication.
    • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98).
    • The article does not list individual CVE identifiers.

    Remediation

    • Apply all relevant patches from the October 2026 CPU.
    • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws.
    • Consult the Oracle advisory, risk matrices and advisory-to-CVE map for details. Tenable plugins for detection will be published as they are released.