By Hamza Faisal

Oracle has closed out 2026's quarterly patch cycle with its largest one yet. The October 2026 Critical Patch Update, published on Tuesday, ships 1,295 security patches covering 1,209 unique CVEs across 33 Oracle product families — from Fusion Middleware and E-Business Suite down to Java, MySQL, and the database server itself.

Of the 1,295 patches, 112 are rated critical (8.6 percent), 475 high, 613 medium, and 95 low, according to Tenable's analysis. It is the final quarterly update of the year, and Oracle is not being subtle about the urgency: the company warns that attackers keep trying to exploit vulnerabilities for which patches already exist, and that some reported attacks succeeded simply because customers never installed the fixes.

The CVSS 10.0 that tops the list

The scariest entry sits in Oracle E-Business Suite. CVE-2026-101809 hits the Workflow Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15, and it carries a CVSS 3.1 score of 10.0 — the highest possible severity rating.

What earns it that score is how little effort an attacker needs: the flaw can be exploited remotely over HTTP with no authentication at all. A successful attack could let someone take over the affected Workflow component and compromise its data or operations, with Oracle warning that the consequences can spread to connected products depending on the environment. E-Business Suite got 194 patches in total this quarter — 31 of them for bugs exploitable remotely without logging in.

It is not the only high-severity headline. The update also carries a CVSS 9.8 vulnerability in Oracle Application Object Library, a CVSS 9.8 flaw tied to OpenSSL in Oracle Database, and a CVSS 9.8 issue in Oracle APEX — all of them serious enough to matter to any enterprise running Oracle's stack.

Fusion Middleware takes the bulk

The most heavily patched product family this quarter is Oracle Fusion Middleware, with 206 patches accounting for nearly 16 percent of the total. That is followed by E-Business Suite at 194 and Siebel CRM at 122. The numbers tell a story about where the attack surface lives: across the whole release, hundreds of the patched flaws can be exploited over a network without authentication.

Java SE alone received 55 patches, 49 of them remotely exploitable without a login. MySQL got 98. Even Oracle Database Server — usually a light load in these updates — picked up 14 fixes, four of them remote without auth. When the quarterly update is this broad, there is no corner of the enterprise portfolio that gets to sit it out.

Patch now — attackers are already trying

The uncomfortable truth Oracle is pushing this quarter is not about any single bug. It is that exploitability is no longer theoretical: attackers are actively attempting to exploit these flaws, and some succeed against unpatched systems. The company's own advisory stresses applying fixes promptly and keeping software versions on an actively supported track.

For security teams, this is one of those Tuesdays that rearranges the week. With 1,295 patches on the table, the triage priority is clear: start with anything internet-facing, work through the unauthenticated-remote-execution flaws in E-Business Suite, Fusion Middleware, and Java, and treat the quarterly CPU as a deadline, not a suggestion. The bugs are public now — so is the clock.

By Hamza Faisal