Oracle's October 2026 Patch Update Fixes 1,295 Vulnerabilities, Including Critical E-Business Suite Flaw
Oracle's latest Critical Patch Update addresses 1,295 vulnerabilities, with a CVSS 10.0 flaw in E-Business Suite Workflow allowing unauthenticated takeover.
Oracle has issued its October 2026 Critical Patch Update (CPU), a significant release that bundles 1,295 security patches across its extensive product portfolio. While the headline number reflects the total patches applied, Oracle notes that this figure includes fixes for vulnerabilities that may affect multiple products. Tenable's analysis breaks this down further, identifying 1,209 unique CVEs impacting 33 distinct Oracle product families, underscoring the breadth of this security initiative.
The most critical vulnerability highlighted in this update is CVE-2026-101809, affecting the E-Business Suite Workflow Notification Mailer component in versions 12.2.3 through 12.2.15. This flaw carries the maximum CVSS 3.1 score of 10.0, indicating a critical severity. Exploitation is possible over HTTP without any authentication, and Oracle describes the vulnerability as easy to exploit. A successful attack could lead to a complete takeover of the Workflow component, potentially compromising sensitive data and disrupting operations. The impact could also extend to other interconnected products that rely on the same application environment.
Beyond the E-Business Suite, other high-severity vulnerabilities demand immediate attention. CVE-2026-101767, rated at CVSS 9.8, affects the Core component of Oracle Application Object Library. This vulnerability allows for remote exploitation via HTTP without requiring credentials or user interaction, impacting supported versions 12.2.3 through 12.2.15. The potential consequences include significant risks to data privacy, data integrity, and service availability.
Another critical issue, CVE-2026-75803, resides within the Database Server's OpenSSL component. This vulnerability, also rated 9.8, can be exploited by an unauthenticated attacker using TLS network access to gain control of the affected component. Oracle Database versions 19.3 through 19.32 and 23.4.0 through 23.26.3 are susceptible to this attack.
Oracle Application Express (APEX) is not spared, with CVE-2026-101521, another 9.8-rated vulnerability, requiring urgent patching. This flaw allows for component takeover via HTTPS without authentication and affects versions 24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4.
Oracle emphasizes the risks associated with delaying patch deployments, citing past incidents where vulnerabilities like CVE-2026-4681 in Oracle Payments and CVE-2025-61882 in E-Business Suite were actively exploited. The company continues to receive reports of successful attacks against customers who have not applied available security updates.
Oracle strongly urges organizations to maintain supported versions of their software and to apply these security updates promptly. Administrators are advised to verify their installed versions against Oracle's affected product tables and follow the provided patch availability documents for detailed installation instructions. For E-Business Suite customers, it is crucial to also review and patch the underlying Database and Fusion Middleware components, as their fixes are documented separately.
While temporary network restrictions might offer a limited reduction in exposure, Oracle cautions that these measures can disrupt application functionality and do not resolve the underlying vulnerabilities. Such mitigations should only be considered short-term protective measures until patches can be deployed.