Oracle has released its October 2026 Critical Patch Update (CPU), the company’s quarterly mega-bundle of security fixes that lands on the third Tuesday of January, April, July, and October each year. This edition ships 1,283 new security patches across dozens of product families — a figure that underscores how deeply Oracle’s technology stack is embedded in global enterprise infrastructure and how relentlessly attackers probe it.
The October CPU arrives at a particularly tense moment for Oracle’s enterprise customers. Earlier this year the ShinHunters threat actor exploited PeopleSoft vulnerabilities, the FBI issued a joint advisory, and Oracle has been shipping monthly Critical Security Patch Updates (CSPUs) throughout the year to plug gaps between its quarterly cadence. Today’s release is the quarterly rollup — authoritative, comprehensive, and the one that triggers formal patch-management deadlines across regulated industries.
1,283 Reasons to Clear Your Calendar
The headline number alone signals urgency: 1,283 new patches in a single quarterly release. For context, Oracle’s July 2026 CPU was already considered a record cycle. October’s count is larger still, reflecting both the expanding Oracle product surface area — driven by aggressive cloud and AI acquisitions — and the increasingly sophisticated tooling that security researchers and threat actors alike are deploying against enterprise software.
Oracle’s advisory notes that it “strongly recommends that customers apply Critical Patch Update patches as soon as possible,” language the company uses consistently but that carries added weight when multiple product families carry CVSS v3.1 scores of 10.0 — the theoretical maximum representing a completely unauthenticated, remotely exploitable flaw with no user interaction required and full system compromise as the outcome.
Fusion Middleware and E-Business Suite: The Twin Towers of Exposure
Two product families tie for the highest patch count at 196 fixes each: Oracle Fusion Middleware and Oracle E-Business Suite (EBS).
Fusion Middleware’s 196 patches include 132 that Oracle rates as remotely exploitable without authentication. That means an attacker with network access to the affected component — WebLogic Server, Oracle HTTP Server, SOA Suite, Identity Manager, Access Manager, WebCenter, Managed File Transfer, or Service Bus — needs no credentials to potentially seize control. At least one Fusion Middleware component carries a CVSS 10.0. For organisations running Oracle’s integration stack or identity platform on-premises, this is not a patch-when-convenient situation.
E-Business Suite’s 196 patches are split differently: 34 are remotely exploitable without authentication. That’s a lower proportion but still a significant count in an application suite that typically runs the financial backbone of large manufacturers, government agencies, and healthcare systems. An unauthenticated path into EBS can mean direct access to purchase orders, payroll data, and general ledger — exactly the data that ransomware operators and financial fraud groups covet.
Both product families carry the maximum 10.0 CVSS score in this CPU. Organisations that have not already applied all prior CSPUs since the July quarterly CPU should treat this October release as an emergency escalation.
The Supporting Cast: PeopleSoft, JD Edwards, Siebel, and Communications
Oracle’s ERP and CRM product lines collectively account for hundreds more patches this cycle.
PeopleSoft receives 109 fixes, 41 of them remotely exploitable without authentication, with a highest CVSS of 9.8. The timing is uncomfortable: the ShinHunters group specifically targeted PeopleSoft in attacks earlier this year, and the FBI’s October advisory last month named PeopleSoft instances exposed to the internet as a prime attack vector. Any organisation still running an internet-facing PeopleSoft portal without the July and August CSPUs applied should treat today’s CPU as a fire drill.
JD Edwards takes 102 patches, with 44 of them unauthenticated remote exploits and a highest CVSS of 10.0. JD Edwards underpins manufacturing, distribution, and project costing for thousands of mid-market firms, many of which run lean IT teams. The 10.0 score in JD Edwards demands immediate attention even at organisations where Oracle patching has historically been a low-priority quarterly ritual.
Oracle Siebel CRM receives 123 patches (67 remotely exploitable without authentication, highest CVSS 9.9). Oracle Communications — the product family covering billing, network orchestration, and messaging for telecommunications carriers — ships 124 patches, 87 of them without-authentication exploits, with a ceiling of 9.8.
Java SE: 49 of 55 Patches Exploitable Without Authentication
Java SE’s 55 patches deserve a special callout because Java runs everywhere: not just on Oracle-branded servers but embedded in third-party commercial software, industrial control systems, developer toolchains, and containers. Of those 55 fixes, 49 are flagged as remotely exploitable without authentication. Organisations whose Oracle support entitlement explicitly covers Java SE should apply today; those running OpenJDK variants from Azul, Red Hat, Eclipse Adoptium, or others should watch upstream release notes for backported fixes arriving in the coming days and weeks.
MySQL: 98 Patches, Mostly Lower Severity
Oracle MySQL receives 98 fixes in October’s CPU, with 29 marked as remotely exploitable. MySQL’s highest score tops out at 9.8. While MySQL does not typically create the enterprise fire-drill urgency of Fusion Middleware or EBS, it is the world’s most-deployed open-source-style relational database, running in cloud-native applications, e-commerce platforms, and SaaS services. Organisations using MySQL Enterprise Edition under Oracle support should apply the October bundle to database instances accessible from application tiers.
What the October CPU Means for Enterprise Patch Programs
Oracle’s hybrid cadence — quarterly CPUs plus monthly CSPUs — has created a two-speed patching reality for enterprise teams. The monthly CSPUs since July have addressed targeted critical issues in specific product families. Today’s quarterly CPU is the omnibus: it incorporates all the CSPUs and adds new findings that did not make the monthly cuts.
For CISOs and compliance teams, the quarterly CPU is the formal trigger. PCI DSS, HIPAA, FedRAMP, and most internal security policies define patch SLAs relative to CVSS scores. With multiple CVSS 10.0 findings across Fusion Middleware, EBS, and JD Edwards, the typical 30-day SLA for critical patches is already counting down. Regulated industries — banking, healthcare, defence — often impose 15-day or even 7-day windows for actively exploited or highest-score vulnerabilities.
The recommended approach this cycle:
- Fusion Middleware and EBS first. The combination of 10.0 CVSS scores and the large count of unauthenticated remote exploits makes these the highest-priority targets. Internet-facing WebLogic, HTTP Server, and EBS login portals should be isolated or patched within 24–72 hours.
- PeopleSoft and JD Edwards next. The ShinHunters context makes PeopleSoft politically urgent as well as technically critical.
- Java SE as a horizontal dependency. Enumerate Java runtime versions embedded in commercial and in-house software before assuming only Oracle-branded server components are in scope.
- MySQL as steady-state. Apply within the standard 30-day window unless specific CVEs are published with active exploit code.
Oracle’s October CPU and the AI Patching Gap
One structural tension visible across this CPU is the growing mismatch between Oracle’s product release velocity — driven by rapid AI feature additions to Fusion Cloud, OCI, and APEX — and the security review cycle needed to keep those new surfaces hardened. Oracle’s Fusion Middleware product family alone now encompasses dozens of AI-adjacent components including the Autonomous Health Framework (CVSS 9.8) and Oracle Trusted Answer Search (CVSS 9.9). These are newer products that enterprises may have deployed only in the past twelve months, and their patch histories are shorter than legacy components like WebLogic or EBS.
The pattern is consistent with what security teams across the enterprise software industry are observing: AI features ship fast, but their security validation trails by months. October’s CPU offers a partial correction, but the underlying dynamic — fast AI, slower security — is likely to persist through 2027.
For Oracle’s 430,000-plus customers worldwide, today’s CPU advisory is the starting gun. The clock to patch is running.
