Threat reportVulnerabilityTL-2026-4382
Oracle October 2026 Critical Patch Update - 1,295 Patches Incl. Maximum-Severity E-Business Suite Workflow Flaw (CVE-2026-101809)
Oracle October 2026 Critical Patch Update (TL-2026-4382), also tracked as Oracle CPU October 2026, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-24. It has no confirmed attribution, affects Oracle E-Business Suite (Workflow Notification Mailer, Application, references 6 CVEs (CVE-2026-101809, CVE-2026-101767, CVE-2026-75803), maps to 6 MITRE ATT&CK techniques (T1005, T1059.007, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4382
- Threat ID
- TL-2026-4382
- Also known as
- Oracle CPU October 2026, Oracle CPUOct2026
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, finance, manufacturing, retail, government administration, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Oracle October 2026 Critical Patch Update
Malware and tooling: Clop
How Oracle October 2026 Critical Patch Update works
Oracle's October 2026 Critical Patch Update (published 2026-10-20) delivers 1,295 security patches (Tenable: 1,209 unique CVEs across 33 product families). Headline flaw CVE-2026-101809, an unauthenticated HTTP takeover of the E-Business Suite Workflow Notification Mailer, is rated CVSS 10.0; no exploitation of it, CISA KEV listing or public PoC had been reported as of 2026-10-21.
Oracle's October 2026 Critical Patch Update (CPU) was released on 2026-10-20 and contains 1,295 security patches. Tenable counts 1,209 unique CVEs across 33 product families. Oracle E-Business Suite (EBS) alone received 194 patches, 31 of them remotely exploitable without credentials.
The headline flaw is CVE-2026-101809 in the Workflow Notification Mailer component of the EBS Workflow product (versions 12.2.3 through 12.2.15). Oracle describes it as easily exploitable by an unauthenticated attacker with network access via HTTP, with no user interaction. Successful exploitation results in takeover of Workflow, and the scope change means other EBS products can be significantly impacted. Because Workflow sends and processes approval e-mails across nearly every EBS module, a takeover can reach the wider suite. The CVSS score is 10.0; one secondary source classifies the weakness as CWE-284 (Improper Access Control). Three more critical (CVSS 9.8) unauthenticated flaws were fixed in the same CPU: CVE-2026-101767 (EBS Application Object Library Core, 12.2.3-12.2.15, CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CVE-2026-75803 (Oracle Database Server OpenSSL component, 19.3-19.32 and 23.4.0-23.26.3, reachable over TLS) and CVE-2026-101521 (Oracle APEX 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4, reachable over HTTPS). Related EBS flaws in the same release include CVE-2026-101634 (Mobile Field Service, CVSS 9.1) and CVE-2026-101808 (Product Workbench, CVSS 9.1).
Exploitation status: as of 2026-10-21 no in-the-wild exploitation, public proof of concept or CISA KEV entry was found for CVE-2026-101809 or CVE-2026-101767. The source article references two earlier EBS issues that were exploited. The first is Oracle Payments CVE-2026-46817 (CVSS 9.8; the hunt skeleton and source article print it as CVE-2026-4681, but corroborating sources give 46817). It was patched in the May 2026 CPU (2026-05-28) with a supplementary patch on 2026-06-16, first reported exploited by Defused on 2026-06-27 and added to CISA KEV on 2026-07-15. Exploitation was unauthenticated POST requests with a crafted XML DeliveryRequest to /OA_HTML/ibytransmit, used to read arbitrary files such as /etc/passwd and configuration files. The second is CVE-2025-61882 (Oracle Concurrent Processing/BI Publisher Integration, CVSS 9.8, versions 12.2.3-12.2.14), a pre-auth RCE chain (SSRF via /configurator/UiServlet, XSL injection fetching ieshostedsurvey.xsl, server-side XSLT evaluation of Base64 JavaScript executed through javax.script.ScriptEngine, then Runtime.exec) exploited as a zero-day by Cl0p from about August 2025. A public exploit bundle was leaked by the Scattered LAPSUS$/ShinyHunters collective in October 2025. These precedents show that unauthenticated, HTTP-reachable EBS flaws are quickly weaponized, so internet-facing EBS 12.2.x instances should be patched first.
Recommended actions: apply the October 2026 CPU/CSPU immediately, since temporary network restrictions are not sufficient. Remove EBS from direct internet exposure where feasible, restrict Workflow and Application Object Library endpoints through a WAF or reverse proxy, review web-tier and Workflow Mailer logs, and review the underlying Database and Fusion Middleware components separately. The primary Oracle CPU advisory could not be retrieved directly (HTTP 403); details come from the secondary sources listed in the references.
MITRE ATT&CK techniques used in TL-2026-4382
Collection
Execution
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.001 Credentials In Files
Reconnaissance
T1595.002 Vulnerability Scanning
Impact
Affected products and versions in Oracle October 2026 Critical Patch Update
- Oracle — E-Business Suite (Workflow Notification Mailer, Application Object Library Core, Payments)
Vulnerable versions: 12.2.3-12.2.15
Fixed in: October 2026 CPU / CSPU applied - Oracle — Database Server (OpenSSL component)
Vulnerable versions: 19.3-19.32; 23.4.0-23.26.3
Fixed in: October 2026 CPU applied - Oracle — Application Express (APEX)
Vulnerable versions: 24.1.0-24.1.21; 24.2.0-24.2.20; 26.1.0-26.1.4
Fixed in: October 2026 CPU applied - Oracle — E-Business Suite Concurrent Processing (CVE-2025-61882, historical)
Vulnerable versions: 12.2.3-12.2.14
Fixed in: October 2025 Security Alert patch
Remediation for Oracle October 2026 Critical Patch Update
Patches
- Oracle October 2026 Critical Patch Update (released 2026-10-20)
- Oracle May 2026 CPU plus 2026-06-16 supplementary patch (CVE-2026-46817)
Immediate actions
- Apply the Oracle October 2026 Critical Patch Update / Critical Security Patch Update to all EBS 12.2.3-12.2.15 instances, internet-facing first
- Apply the October 2026 CPU to Oracle Database (19.3-19.32, 23.4.0-23.26.3) and APEX (24.1.x, 24.2.x, 26.1.x) for CVE-2026-75803 and CVE-2026-101521
- Confirm the May 2026 CPU plus the 2026-06-16 supplementary patch are applied for CVE-2026-46817 (exploited, CISA KEV)
- Review web-tier and Workflow Notification Mailer logs for unauthenticated requests to Workflow and Application Object Library endpoints
Workarounds
- Restrict EBS web tier access to trusted networks only
- Deploy WAF or reverse-proxy rules restricting Workflow and Application Object Library endpoints; temporary network restrictions are not a substitute for patching
Longer-term hardening
- Remove E-Business Suite from direct internet exposure; publish only required modules via a reverse proxy
- Check installed versions against Oracle's affected-product tables and review underlying Database and Fusion Middleware components separately
- Keep a regular CPU cadence for EBS, since unauthenticated EBS flaws have been exploited within weeks
CVEs associated with Oracle October 2026 Critical Patch Update
CVE-2026-101809, CVE-2026-101767, CVE-2026-75803, CVE-2026-101521, CVE-2026-46817, CVE-2025-61882
Weaknesses (CWE) in Oracle October 2026 Critical Patch Update
Timeline of Oracle October 2026 Critical Patch Update
- Circa August 2025: Cl0p begins exploiting Oracle EBS CVE-2025-61882 as a zero-day (month approximate per sources).
- Cl0p-attributed extortion emails reach Oracle EBS customers claiming data theft; Oracle confirms on 2025-10-03.
- Oracle publishes Security Alert Advisory and patch for CVE-2025-61882 including indicators of compromise.
- CISA adds CVE-2025-61882 to KEV; the Scattered LAPSUS$/ShinyHunters collective leaks an exploit bundle (exp.py, server.py).
- Oracle May 2026 CPU patches EBS Payments flaw CVE-2026-46817 (supplementary patch follows on 2026-06-16).
- Defused reports six unauthenticated file-read attempts against /OA_HTML/ibytransmit from 45.84.137.125 (CVE-2026-46817).
- CISA adds the Oracle EBS Payments flaw CVE-2026-46817 to KEV; FCEB deadline 2026-07-18.
- Oracle releases the October 2026 CPU with 1,295 patches, including CVSS 10.0 EBS Workflow flaw CVE-2026-101809.
- Coverage published; CVE-2026-101809 and CVE-2026-101767 not in CISA KEV, with no reported exploitation or public PoC.
Sources cited for Oracle October 2026 Critical Patch Update
- Massive Oracle Security Update - 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability
- Oracle Critical Patch Update Advisory - October 2026
- Oracle E-Business Suite Vulnerability CVE-2026-101809 (SecurityOnline)
- Oracle E-Business Suite CVE-2026-101767 - Prepare Now (Rescana)
- Critical Vulnerability in Oracle Payments Product Under Active Exploitation (CVE-2026-46817) - Beazley Security
- Rapid7 ETR: CVE-2025-61882 Critical 0-day in Oracle E-Business Suite Exploited in the Wild
- Tenable: CVE-2025-61882 FAQ - Oracle E-Business Suite Zero-Day, Cl0p and July 2025 CPU
- Oracle E-Business Suite Releases - Critical Security Patch Update for September 2026
Detection coverage for TL-2026-4382
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4382 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.