/
← Voltar ao feed
high

Oracle October 2026 CPU: 1,295 patches for 1,209 CVEs, with unauthenticated CVSS 9.8–9.9 flaws in Database, APEX and Essbase

3 fonte(s) · 3 atualização(ões) · publicado 20/10/2026 18:58 · coletado há 1 dia

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 23/10/2026 00:03; os links antigos trazem para cá.

Fontes: securityweek.com ↗ gbhackers.com ↗ tenable.com ↗

Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It delivers 1,295 security patches for 1,209 unique CVEs across 33 product families (tenable.com, securityweek.com). The patch count is higher than the CVE count because one CVE can appear in several product matrices (gbhackers.com). 112 patches (8.6%) are rated critical and cover 95 CVEs (tenable.com). Tenable published its breakdown by severity and product family on October 20 (21:58 UTC), and GBHackers followed on October 21 (09:18 UTC) with details on the critical unauthenticated flaws in Database, APEX and Essbase. Several fixes address flaws that can be exploited remotely without authentication in databases, middleware, business applications, Java, MySQL and virtualization platforms (gbhackers.com). No source names any CVE as exploited in the wild, and SecurityWeek confirms Oracle has not flagged any of the flaws as exploited (securityweek.com). Oracle warned that attackers keep targeting vulnerabilities that already have patches, and that some successful attacks happened because customers had not applied fixes (gbhackers.com). It also reminds customers that it periodically receives reports of exploitation attempts against its products (securityweek.com). On October 21, one day after the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403 (securityweek.com).

Entenda a falha

A vulnerabilidade

This is a patch roundup, not one flaw. The most severe are four Oracle Essbase flaws, CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663 (CVSS 9.9, version 21.8.3.0.0). They need low privileges and no user interaction, over HTTP or T3/IIOP. Next, at 9.8: CVE-2026-75803 (OpenSSL component of Oracle Database Server, unauthenticated over TLS, versions 19.3-19.32 and 23.4.0-23.26.3; rated 9.1 in Autonomous Health Framework 26.3-26.8), CVE-2026-101521 (Oracle APEX, unauthenticated over HTTPS, versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4) and CVE-2026-91665 (Essbase, unauthenticated over TCP). CVE-2026-66010 (DOMPurify bundled with APEX, 6.1) needs user interaction. CVE-2026-91403 is Oracle's response to the eMudhra weak-key incident. The articles list no fixed versions; the fix is the October 2026 CPU.

Como funciona

The articles do not describe the internal mechanism of any of these flaws. They give only the entry points. For CVE-2026-75803, the attacker reaches the OpenSSL component of Database Server over TLS without credentials. For CVE-2026-101521, the request arrives over HTTPS at the APEX General component. For the Essbase flaws, the request arrives over HTTP or T3/IIOP from a low-privileged account, or over TCP for CVE-2026-91665 without authentication. At which step each one fails is not stated.

Por que é vulnerável

The articles do not state the root cause of any of these CVEs. They only note that some affected components are third-party code bundled into Oracle products (OpenSSL in Database Server and Autonomous Health Framework, DOMPurify in APEX), which is why the same CVE can get different severity ratings depending on the product. They do not say what the fixes change.

Como foi descoberta

Oracle released the CPU on October 20 and Tenable analyzed it for the CVE counts and severity breakdown. GBHackers then detailed the critical flaws in Database, APEX and Essbase. The articles do not say who found the individual flaws. Oracle has not flagged any as exploited in the wild, but says attackers keep targeting flaws that already have patches and that it periodically receives reports of exploitation attempts. On October 21, Oracle published a separate advisory and security alert for CVE-2026-91403. CSPUs follow on November 17 and December 15, and the next CPU is January 19, 2027.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:18.

Detalhes técnicos

  • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93 (tenable.com). SecurityWeek, citing Tenable, reports the same CVE counts: 95 critical, 439 high and 582 medium (securityweek.com).
  • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite has 194 (15%), 31 without authentication (tenable.com, securityweek.com).
  • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98) (tenable.com).
  • Largest patch volumes by product: Fusion Middleware (206), E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) and Supply Chain (50) (securityweek.com).
  • Other patched products include Essbase, REST Data Services, Database Server, Enterprise Manager, GoldenGate, Secure Backup, Virtualization, Commerce, APEX, NoSQL Database and SQL Developer (securityweek.com).
  • CVE-2026-75803: OpenSSL component in Oracle Database Server, CVSS 3.1 9.8, exploitable unauthenticated over TLS with no user interaction. Affects 19.3–19.32 and 23.4.0–23.26.3. The same CVE is rated 9.1 in Oracle Autonomous Health Framework (versions 26.3–26.8) (gbhackers.com).
  • CVE-2026-101521: Oracle APEX General component, CVSS 9.8, unauthenticated network exploitation over HTTPS with low complexity. Affects 24.1.0–24.1.21, 24.2.0–24.2.20 and 26.1.0–26.1.4 (gbhackers.com).
  • CVE-2026-66010: DOMPurify component bundled with APEX, CVSS 6.1, requires user interaction (gbhackers.com).
  • Oracle Essbase has 38 patches, 14 of them remotely exploitable without authentication. CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663 score 9.9 on version 21.8.3.0.0. They need low privileges and no user interaction, via HTTP or T3/IIOP. CVE-2026-91665 scores 9.8 and is unauthenticated over TCP (gbhackers.com).
  • Oracle Database Products received 126 patches. The Database Server accounts for 14, four of them remotely exploitable without authentication (gbhackers.com).
  • CVE-2026-91403: covered by a separate Oracle advisory and security alert published one day after the CPU. It is Java's and Oracle's response to the eMudhra weak-key incident (securityweek.com).
  • Tenable's article does not list individual CVE identifiers (tenable.com).

Remediação

  • Apply the October 2026 CPU as soon as possible. Map deployed versions against Oracle's affected product tables and risk matrices (gbhackers.com, tenable.com).
  • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws (tenable.com). SecurityWeek likewise highlights internet-facing Fusion Middleware, E-Business Suite, PeopleSoft and Siebel CRM (securityweek.com).
  • Review the CVE-2026-91403 security alert for the eMudhra weak-key issue (securityweek.com).
  • Oracle will release Critical Security Patch Updates (CSPUs) on November 17 and December 15. The next CPU is scheduled for January 19, 2027 (securityweek.com).
  • Temporary mitigations include blocking the protocols needed for exploitation and removing unnecessary privileges and package access. These may break applications, need testing outside production, and do not fix the underlying flaws (gbhackers.com).
  • Review earlier advisories if prior updates were skipped (gbhackers.com).
  • Upgrade unsupported releases, which are not tested for these flaws and may still be affected (gbhackers.com).
  • Consult the Oracle advisory, risk matrices and advisory-to-CVE map. Tenable detection plugins will be published as they are released (tenable.com).

Linha do tempo

  1. securityweek.com ↗ · pub. 22/10/2026 04:38 · coletado 22/10 06:00

    Oracle October 2026 CPU fixes 1,209 unique CVEs, 95 critical, with no exploitation flagged

    ler a análise desta fonte

    Oracle released its October 2026 Critical Patch Update (CPU) with 1,295 new fixes across dozens of products. Tenable counts 1,209 unique CVEs: 95 critical, 439 high and 582 medium severity. Oracle Fusion Middleware received the most fixes (206), of which 134 are remotely exploitable without authentication. Oracle has not flagged any of the flaws as exploited in the wild, but it reminds customers that it periodically receives reports of exploitation attempts against its products.

    Technical Details

    • Largest patch volumes by product: Fusion Middleware (206), E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) and Supply Chain (50).
    • Other patched products include Essbase, REST Data Services, Database Server, Enterprise Manager, GoldenGate, Secure Backup, Virtualization, Commerce, APEX, NoSQL Database and SQL Developer.
    • One day after the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403, Java's and Oracle's response to the eMudhra weak-key incident.

    Remediation

    • Apply the October 2026 CPU patches, prioritizing internet-facing Fusion Middleware, E-Business Suite, PeopleSoft and Siebel CRM.
    • Review the CVE-2026-91403 security alert for the eMudhra weak-key issue.
    • Oracle will release Critical Security Patch Updates (CSPUs) on November 17 and December 15. The next CPU is scheduled for January 19, 2027.
  2. gbhackers.com ↗ · pub. 21/10/2026 06:18 · coletado 21/10 08:00

    Oracle October 2026 CPU ships 1,295 patches, including multiple unauthenticated CVSS 9.8–9.9 flaws in Database, APEX and Essbase

    ler a análise desta fonte

    Oracle published its October 2026 Critical Patch Update on October 20, delivering 1,295 security patches across Oracle software and third-party components. Several fixes address critical flaws that can be exploited remotely without authentication, affecting databases, middleware, business applications, Java, MySQL and virtualization platforms. Oracle warned that attackers keep trying to exploit vulnerabilities that already have patches, and that some successful attacks occurred because customers had not applied fixes. The article does not name any specific CVE as exploited in the wild. The 1,295 figure counts patches, not unique vulnerabilities, since one CVE can appear in multiple product matrices.

    Technical Details

    • CVE-2026-75803: OpenSSL component in Oracle Database Server, CVSS 3.1 9.8, exploitable unauthenticated over TLS with no user interaction. Affects 19.3–19.32 and 23.4.0–23.26.3. The same CVE is rated 9.1 in Oracle Autonomous Health Framework (versions 26.3–26.8).
    • CVE-2026-101521: Oracle APEX General component, CVSS 9.8, unauthenticated network exploitation over HTTPS with low complexity. Affects 24.1.0–24.1.21, 24.2.0–24.2.20 and 26.1.0–26.1.4.
    • CVE-2026-66010: DOMPurify component bundled with APEX, CVSS 6.1, requires user interaction.
    • Oracle Essbase (38 patches, 14 remotely exploitable without authentication): CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663 score 9.9 on version 21.8.3.0.0. They need low privileges and no user interaction, via HTTP or T3/IIOP. CVE-2026-91665 scores 9.8 and is unauthenticated over TCP.
    • Oracle Database Products received 126 patches. The Database Server accounts for 14 of them, four of which are remotely exploitable without authentication.

    Remediation

    • Apply the October 2026 CPU as soon as possible, mapping deployed versions against Oracle's affected product tables and risk matrices.
    • Temporary mitigations include blocking the protocols needed for exploitation and removing unnecessary privileges and package access. These may break applications, need testing outside production, and do not fix the underlying flaws.
    • Review earlier advisories if prior updates were skipped.
    • Upgrade unsupported releases, which are not tested for these flaws and may still be affected.
  3. tenable.com ↗ · pub. 20/10/2026 18:58 · coletado 20/10 20:00 primeiro registro

    Oracle October 2026 CPU fixes 1,209 CVEs in 1,295 patches, including 112 critical updates

    ler a análise desta fonte

    Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It fixes 1209 unique CVEs in 1295 security updates across 33 product families. 112 of the patches (8.6%) are rated critical and cover 95 CVEs. The article does not mention exploitation in the wild.

    Technical Details

    • Severity breakdown (patches / CVEs): Critical 112/95, High 475/439, Medium 613/582, Low 95/93.
    • Oracle Fusion Middleware has the most patches (206, 15.9%), 134 of them remotely exploitable without authentication. Oracle E-Business Suite follows with 194 (15%), 31 without authentication.
    • Other families with many unauthenticated remote issues: Oracle Communications (77 of 110), Oracle Siebel CRM (66 of 122), Oracle Java SE (49 of 55), Oracle JD Edwards (44 of 102), Oracle PeopleSoft (41 of 109) and Oracle MySQL (29 of 98).
    • The article does not list individual CVE identifiers.

    Remediation

    • Apply all relevant patches from the October 2026 CPU.
    • Prioritize internet-exposed Fusion Middleware, E-Business Suite, Siebel CRM, Communications and Java SE deployments, given the number of unauthenticated network-exploitable flaws.
    • Consult the Oracle advisory, risk matrices and advisory-to-CVE map for details. Tenable plugins for detection will be published as they are released.