# Oracle October 2026 Critical Patch Update: 1,295 fixes covering 1,209 unique CVEs (four CVSS 10.0 Fusion Middleware flaws, CVE-2026-101767 EBS SQLi)

> Oracle's October 2026 CPU (released 2026-10-20) delivers 1,295 security fixes covering 1,209 unique CVEs (95 Critical, 439 High, 582 Medium), led by Fusion Middleware (206 patches, 134 remotely exploitable without authentication) and E-Business Suite (194). Oracle has not flagged any of the flaws as exploited in the wild.

- **Published:** 2026-10-23T08:56:46Z
- **Last reviewed:** 2026-10-23T08:56:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4249
- **ID:** TL-2026-4249
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-87337, CVE-2026-91216, CVE-2026-91221, CVE-2026-91231, CVE-2026-83399, CVE-2026-91214, CVE-2026-101767, CVE-2026-91403

## Description

Oracle's October 2026 Critical Patch Update, published on 2026-10-20, is one of the largest in the program's history. According to SecurityWeek (2026-10-22) it contains 1,295 security fixes addressing 1,209 unique CVEs: 95 Critical, 439 High and 582 Medium. The most affected product families are Fusion Middleware (206 patches, 134 of them remotely exploitable without authentication), E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) and Supply Chain (50). Other families patched include Essbase, REST Data Services, Analytics, Database Server, Enterprise Manager, GoldenGate, Secure Backup, Virtualization, Autonomous Health Framework, Financial Services, Retail, TimesTen, Healthcare, Hospitality, Commerce, APEX, Application Testing Suite, Global Lifecycle Management, NoSQL Database and SQL Developer. Note: the Oracle advisory snippet surfaced by search reports '1283 new security patches' while SecurityWeek and other outlets report 1,295; the Oracle advisory page itself returned HTTP 403 to the analyst, so the discrepancy could not be reconciled and the SecurityWeek figure is used in the title and summary.

Secondary reporting (securityonline.info, 2026-10-21) identifies four Fusion Middleware flaws with CVSS 3.1 base score 10.0: CVE-2026-87337 (Oracle Access Manager, Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0, unauthenticated HTTP, scope change, full read/write access to Access Manager data); CVE-2026-91216 and CVE-2026-91221 (Oracle SOA Suite, Fabric Layer, 12.2.1.4.0 and 14.1.2.0.0, unauthenticated via T3 and IIOP, complete takeover); and CVE-2026-91231 (Oracle SOA Suite, Adapters, 12.2.1.4.0 and 14.1.2.0.0, unauthenticated HTTP, scope change, complete takeover). The same source lists CVE-2026-83399 (WebLogic Server Core, CVSS 9.8, T3/IIOP, takeover), and a separate report lists CVE-2026-91214 (SOA Suite Fabric Layer, CVSS 9.8, unauthenticated HTTP, takeover).

In E-Business Suite, CVE-2026-101767 (Oracle Application Object Library, CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, versions 12.2.3 through 12.2.15) is described by Rescana as an unauthenticated SQL injection in the EBS Thin Client Framework servlet (/OA_HTML/AppsTCFServer) that executes SQL as the APPS database user and can be chained to OS command execution as the EBS application account. Rescana states there is no known public exploitation or proof of concept as of 2026-10-21 and that the CVE is not in CISA KEV. These per-CVE details come from third-party blogs, not from Oracle's advisory, which the analyst could not read; treat them as unverified until checked against the Oracle risk matrices.

SecurityWeek also notes a separate Oracle advisory dated 2026-10-23 for CVE-2026-91403 covering 'Java's response to the eMudhra weak-key incident'. The eMudhra incident (eight intermediate CA keys with trivially weak private keys, one of them the value 4; browsers distrusting the affected chain) is a separate certificate-authority issue reported in the press; no further detail on Oracle's CVE-2026-91403 advisory could be found in the sources reached.

Oracle states none of the CPU vulnerabilities have been flagged as exploited in the wild. Upcoming Critical Security Patch Updates (CSPUs) are scheduled for 2026-11-17 and 2026-12-15, and the next CPU for 2027-01-19. No actor attribution, network IOCs or malware are associated with this release.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation

## Sources

- [Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU](https://www.securityweek.com/oracle-patches-over-1200-vulnerabilities-with-october-2026-cpu/)
- [Oracle Critical Patch Update Advisory - October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)
- [Oracle Fusion Middleware Vulnerabilities Include Four CVSS 10 Bugs](https://securityonline.info/oracle-fusion-middleware-vulnerabilities-october-2026/)
- [Oracle Critical Patch Update October 2026 Fixes 1,209 CVEs](https://securityonline.info/oracle-critical-patch-update-october-2026/)
- [Oracle E-Business Suite CVE-2026-101767: Critical (CVSS 9.8) Unauthenticated Flaw](https://www.rescana.com/post/oracle-e-business-suite-cve-2026-101767-prepare-now)
- [October 2026 Oracle Critical Patch Update Analysis (Fortra)](https://www.fortra.com/blog/october-2026-oracle-critical-patch-update-analysis)
- [Oracle Releases Massive Security Update for Fusion Middleware and E-Business Suite](https://cyberpress.org/oracle-releases-massive-security-update/)
- [Oracle October 2026 Patch Update Fixes 1,295 Issues](https://cyberupdates365.com/oracle-october-2026-patch-update/)
- [CVE-2026-91214: Oracle SOA Suite Vulnerability (CVSS 9.8)](https://www.strix.ai/cve/CVE-2026-91214)
- [eMudhra faces scrutiny after weak certificate keys raise web security concerns](https://yourstory.com/2026/10/emudhra-faces-scrutiny-after-weak-certificate-keys-raise-web-security-concerns)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4249