# Oracle October 2026 Critical Patch Update - 1,295 Patches Incl. Maximum-Severity E-Business Suite Workflow Flaw (CVE-2026-101809)

> Oracle's October 2026 Critical Patch Update (published 2026-10-20) delivers 1,295 security patches (Tenable: 1,209 unique CVEs across 33 product families). Headline flaw CVE-2026-101809, an unauthenticated HTTP takeover of the E-Business Suite Workflow Notification Mailer, is rated CVSS 10.0; no exploitation of it, CISA KEV listing or public PoC had been reported as of 2026-10-21.

- **Published:** 2026-10-24T12:47:03Z
- **Last reviewed:** 2026-10-24T12:47:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4382
- **ID:** TL-2026-4382
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-101809, CVE-2026-101767, CVE-2026-75803, CVE-2026-101521, CVE-2026-46817, CVE-2025-61882

## Description

Oracle's October 2026 Critical Patch Update (CPU) was released on 2026-10-20 and contains 1,295 security patches. Tenable counts 1,209 unique CVEs across 33 product families. Oracle E-Business Suite (EBS) alone received 194 patches, 31 of them remotely exploitable without credentials.

The headline flaw is CVE-2026-101809 in the Workflow Notification Mailer component of the EBS Workflow product (versions 12.2.3 through 12.2.15). Oracle describes it as easily exploitable by an unauthenticated attacker with network access via HTTP, with no user interaction. Successful exploitation results in takeover of Workflow, and the scope change means other EBS products can be significantly impacted. Because Workflow sends and processes approval e-mails across nearly every EBS module, a takeover can reach the wider suite. The CVSS score is 10.0; one secondary source classifies the weakness as CWE-284 (Improper Access Control). Three more critical (CVSS 9.8) unauthenticated flaws were fixed in the same CPU: CVE-2026-101767 (EBS Application Object Library Core, 12.2.3-12.2.15, CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CVE-2026-75803 (Oracle Database Server OpenSSL component, 19.3-19.32 and 23.4.0-23.26.3, reachable over TLS) and CVE-2026-101521 (Oracle APEX 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4, reachable over HTTPS). Related EBS flaws in the same release include CVE-2026-101634 (Mobile Field Service, CVSS 9.1) and CVE-2026-101808 (Product Workbench, CVSS 9.1).

Exploitation status: as of 2026-10-21 no in-the-wild exploitation, public proof of concept or CISA KEV entry was found for CVE-2026-101809 or CVE-2026-101767. The source article references two earlier EBS issues that were exploited. The first is Oracle Payments CVE-2026-46817 (CVSS 9.8; the hunt skeleton and source article print it as CVE-2026-4681, but corroborating sources give 46817). It was patched in the May 2026 CPU (2026-05-28) with a supplementary patch on 2026-06-16, first reported exploited by Defused on 2026-06-27 and added to CISA KEV on 2026-07-15. Exploitation was unauthenticated POST requests with a crafted XML DeliveryRequest to /OA_HTML/ibytransmit, used to read arbitrary files such as /etc/passwd and configuration files. The second is CVE-2025-61882 (Oracle Concurrent Processing/BI Publisher Integration, CVSS 9.8, versions 12.2.3-12.2.14), a pre-auth RCE chain (SSRF via /configurator/UiServlet, XSL injection fetching ieshostedsurvey.xsl, server-side XSLT evaluation of Base64 JavaScript executed through javax.script.ScriptEngine, then Runtime.exec) exploited as a zero-day by Cl0p from about August 2025. A public exploit bundle was leaked by the Scattered LAPSUS$/ShinyHunters collective in October 2025. These precedents show that unauthenticated, HTTP-reachable EBS flaws are quickly weaponized, so internet-facing EBS 12.2.x instances should be patched first.

Recommended actions: apply the October 2026 CPU/CSPU immediately, since temporary network restrictions are not sufficient. Remove EBS from direct internet exposure where feasible, restrict Workflow and Application Object Library endpoints through a WAF or reverse proxy, review web-tier and Workflow Mailer logs, and review the underlying Database and Fusion Middleware components separately. The primary Oracle CPU advisory could not be retrieved directly (HTTP 403); details come from the secondary sources listed in the references.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1657 Financial Theft

## Sources

- [Massive Oracle Security Update - 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability](https://cybersecuritynews.com/massive-oracle-security-update/)
- [Oracle Critical Patch Update Advisory - October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)
- [Oracle E-Business Suite Vulnerability CVE-2026-101809 (SecurityOnline)](https://securityonline.info/oracle-e-business-suite-vulnerability-cve-2026-101809/)
- [Oracle E-Business Suite CVE-2026-101767 - Prepare Now (Rescana)](https://www.rescana.com/post/oracle-e-business-suite-cve-2026-101767-prepare-now)
- [Critical Vulnerability in Oracle Payments Product Under Active Exploitation (CVE-2026-46817) - Beazley Security](https://beazley.security/alerts-advisories/critical-vulnerability-in-oracle-payments-product-under-active-exploitation-cve-2026-46817)
- [Rapid7 ETR: CVE-2025-61882 Critical 0-day in Oracle E-Business Suite Exploited in the Wild](https://www.rapid7.com/blog/post/etr-cve-2025-61882-critical-0day-in-oracle-e-business-suite-exploited-in-the-wild)
- [Tenable: CVE-2025-61882 FAQ - Oracle E-Business Suite Zero-Day, Cl0p and July 2025 CPU](https://www.tenable.com/blog/cve-2025-61882-faq-oracle-e-business-suite-zero-day-cl0p-and-july-2025-cpu)
- [Oracle E-Business Suite Releases - Critical Security Patch Update for September 2026](https://blogs.oracle.com/ebstech/critical-security-patch-update-for-september-2026-now-available)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4382