Threat reportVulnerabilityTL-2026-4249
Oracle October 2026 Critical Patch Update: 1,295 fixes covering 1,209 unique CVEs (four CVSS 10.0 Fusion Middleware flaws, CVE-2026-101767 EBS SQLi)
Oracle October 2026 Critical Patch Update (TL-2026-4249), also tracked as Oracle CPU October 2026, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-23. It has no confirmed attribution, affects Oracle Fusion Middleware (WebLogic Server, SOA Suite, Access Manager), references 8 CVEs (CVE-2026-87337, CVE-2026-91216, CVE-2026-91221), maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1213), and is covered by 9 detection rules and 2 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 2Indicators of compromise
Key facts for TL-2026-4249
- Threat ID
- TL-2026-4249
- Also known as
- Oracle CPU October 2026, cpuoct2026
- Severity
- CRITICAL
- CVSS
- 10
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, finance, government administration, health, retail, telecoms, hospitality
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 2
How Oracle October 2026 Critical Patch Update works
Oracle's October 2026 CPU (released 2026-10-20) delivers 1,295 security fixes covering 1,209 unique CVEs (95 Critical, 439 High, 582 Medium), led by Fusion Middleware (206 patches, 134 remotely exploitable without authentication) and E-Business Suite (194). Oracle has not flagged any of the flaws as exploited in the wild.
Oracle's October 2026 Critical Patch Update, published on 2026-10-20, is one of the largest in the program's history. According to SecurityWeek (2026-10-22) it contains 1,295 security fixes addressing 1,209 unique CVEs: 95 Critical, 439 High and 582 Medium. The most affected product families are Fusion Middleware (206 patches, 134 of them remotely exploitable without authentication), E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) and Supply Chain (50). Other families patched include Essbase, REST Data Services, Analytics, Database Server, Enterprise Manager, GoldenGate, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services, Retail, TimesTen, Healthcare, Hospitality, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database and SQL Developer. Note: the Oracle advisory snippet surfaced by search reports '1283 new security patches' while SecurityWeek and other outlets report 1,295; the Oracle advisory page itself returned HTTP 403 to the analyst, so the discrepancy could not be reconciled and the SecurityWeek figure is used in the title and summary.
Secondary reporting (securityonline.info, 2026-10-21) identifies four Fusion Middleware flaws with CVSS 3.1 base score 10.0: CVE-2026-87337 (Oracle Access Manager, Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0, unauthenticated HTTP, scope change, full read/write access to Access Manager data); CVE-2026-91216 and CVE-2026-91221 (Oracle SOA Suite, Fabric Layer, 12.2.1.4.0 and 14.1.2.0.0, unauthenticated via T3 and IIOP, complete takeover); and CVE-2026-91231 (Oracle SOA Suite, Adapters, 12.2.1.4.0 and 14.1.2.0.0, unauthenticated HTTP, scope change, complete takeover). The same source lists CVE-2026-83399 (WebLogic Server Core, CVSS 9.8, T3/IIOP, takeover), and a separate report lists CVE-2026-91214 (SOA Suite Fabric Layer, CVSS 9.8, unauthenticated HTTP, takeover).
In E-Business Suite, CVE-2026-101767 (Oracle Application Object Library, CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, versions 12.2.3 through 12.2.15) is described by Rescana as an unauthenticated SQL injection in the EBS Thin Client Framework servlet (/OA_HTML/AppsTCFServer) that executes SQL as the APPS database user and can be chained to OS command execution as the EBS application account. Rescana states there is no known public exploitation or proof of concept as of 2026-10-21 and that the CVE is not in CISA KEV. These per-CVE details come from third-party blogs, not from Oracle's advisory, which the analyst could not read; treat them as unverified until checked against the Oracle risk matrices.
SecurityWeek also notes a separate Oracle advisory dated 2026-10-23 for CVE-2026-91403 covering 'Java's response to the eMudhra weak-key incident'. The eMudhra incident (eight intermediate CA keys with trivially weak private keys, one of them the value 4; browsers distrusting the affected chain) is a separate certificate-authority issue reported in the press; no further detail on Oracle's CVE-2026-91403 advisory could be found in the sources reached.
Oracle states none of the CPU vulnerabilities have been flagged as exploited in the wild. Upcoming Critical Security Patch Updates (CSPUs) are scheduled for 2026-11-17 and 2026-12-15, and the next CPU for 2027-01-19. No actor attribution, network IOCs or malware are associated with this release.
MITRE ATT&CK techniques used in TL-2026-4249
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
Affected products and versions in Oracle October 2026 Critical Patch Update
- Oracle — Fusion Middleware (WebLogic Server, SOA Suite, Access Manager)
Vulnerable versions: SOA Suite 12.2.1.4.0; SOA Suite 14.1.2.0.0; Access Manager 12.2.1.4.0; Access Manager 14.1.2.1.0
Fixed in: October 2026 CPU patches - Oracle — E-Business Suite (Application Object Library)
Vulnerable versions: 12.2.3 through 12.2.15
Fixed in: October 2026 CPU patches - Oracle — Siebel CRM, Communications, PeopleSoft, JD Edwards, MySQL, Java SE, Supply Chain, Database Server, APEX and other CPU-covered products
Vulnerable versions: See Oracle CPU October 2026 risk matrices
Fixed in: October 2026 CPU patches
Remediation for Oracle October 2026 Critical Patch Update
Patches
- Oracle Critical Patch Update October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html)
- Oracle CSPUs scheduled for 2026-11-17 and 2026-12-15
Immediate actions
- Apply the October 2026 Critical Patch Update, prioritizing internet-facing Fusion Middleware (WebLogic, SOA Suite, Access Manager) and E-Business Suite
- Restrict T3 and IIOP access to WebLogic/SOA Suite to trusted networks only
- Remove /OA_HTML/AppsTCFServer from external firewall allowlists until EBS is patched
- Review EBS web logs for unauthenticated POSTs to /OA_HTML/AppsTCFServer followed by database activity
Workarounds
- Block T3/IIOP at the network perimeter
- Limit EBS web tier access to trusted networks
Longer-term hardening
- Keep Oracle CPU and CSPU dates (2026-11-17, 2026-12-15, 2027-01-19) in the patch calendar
- Do not expose EBS, WebLogic or Access Manager administrative or T3/IIOP interfaces directly to the internet
- Inventory Oracle assets by product family and version against the CPU risk matrices
CVEs associated with Oracle October 2026 Critical Patch Update
CVE-2026-87337, CVE-2026-91216, CVE-2026-91221, CVE-2026-91231, CVE-2026-83399, CVE-2026-91214, CVE-2026-101767, CVE-2026-91403
Weaknesses (CWE) in Oracle October 2026 Critical Patch Update
Timeline of Oracle October 2026 Critical Patch Update
- Pre-release guidance advises building the patch queue ahead of the Oracle October 2026 CPU (aboutinfosec.com)
- Oracle publishes the October 2026 Critical Patch Update covering Fusion Middleware, E-Business Suite, Siebel CRM, PeopleSoft, MySQL, Java SE and other products
- Rescana analysis of EBS CVE-2026-101767 (CVSS 9.8) reports no known public exploitation or PoC and no CISA KEV listing
- Secondary reporting identifies four CVSS 10.0 Fusion Middleware flaws (CVE-2026-87337, CVE-2026-91216, CVE-2026-91221, CVE-2026-91231) plus WebLogic CVE-2026-83399 (9.8)
- SecurityWeek reports 1,295 fixes and 1,209 unique CVEs (95 Critical, 439 High, 582 Medium); Oracle flags none as exploited in the wild
- Oracle issues a separate advisory for CVE-2026-91403 on Java's response to the eMudhra weak-key incident
- Scheduled Oracle Critical Security Patch Update
- Scheduled Oracle Critical Security Patch Update
- Scheduled next Oracle Critical Patch Update (January 2027)
Sources cited for Oracle October 2026 Critical Patch Update
- Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
- Oracle Critical Patch Update Advisory - October 2026
- Oracle Fusion Middleware Vulnerabilities Include Four CVSS 10 Bugs
- Oracle Critical Patch Update October 2026 Fixes 1,209 CVEs
- Oracle E-Business Suite CVE-2026-101767: Critical (CVSS 9.8) Unauthenticated Flaw
- October 2026 Oracle Critical Patch Update Analysis (Fortra)
- Oracle Releases Massive Security Update for Fusion Middleware and E-Business Suite
- Oracle October 2026 Patch Update Fixes 1,295 Issues
- CVE-2026-91214: Oracle SOA Suite Vulnerability (CVSS 9.8)
- eMudhra faces scrutiny after weak certificate keys raise web security concerns
Detection coverage for TL-2026-4249
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4249 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.