Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Oracle has issued its October 2026 Critical Patch Update, delivering 1,295 fixes that cover 1,209 distinct CVEs, according to analysis from Tenable. Of these, 95 are rated critical, 439 high severity, and 582 medium severity. Fusion Middleware received the largest share with 206 fixes, 134 of which are remotely exploitable without authentication, while E-Business Suite (194), Siebel CRM (122), PeopleSoft (109), JD Edwards (102), MySQL (98) and Java SE (55) also saw substantial patching. Oracle says none of the flaws fixed in this round are currently known to be exploited, though it continues to see sporadic attack attempts against its software. Separately, the company issued an out-of-band advisory for CVE-2026-91403 in Java, tied to the eMudhra weak-key certificate issue, and confirmed its next regular updates will land November 17, December 15, and the following full CPU on January 19, 2027.