Oracle Critical Patch Update, October 2026: network-reachable takeover flaws lead 426 fixes

The release at a glance

Oracle's October 2026 Critical Patch Update covers 426 CVEs. The advisory breaks down as 38 critical, 200 high, 161 medium and 27 low severity. Oracle E-Business Suite carries the largest share with 194 CVEs, followed by Oracle Fusion Middleware with 170, Oracle Java SE with 52, Oracle Database Server with 9 and Oracle PeopleSoft with 1. None of the CVEs appears in CISA's KEV catalogue, and none is marked as exploited in the advisory data. The most pressing entries are a group of unauthenticated, network-reachable flaws in Oracle Fusion Middleware and Oracle E-Business Suite, a number of them rated CVSS 10.0.

What matters most

In Oracle E-Business Suite, CVE-2026-101809 affects Workflow (Workflow Notification Mailer) versions 12.2.3 to 12.2.15. It is easily exploitable over HTTP without credentials and can result in takeover of Workflow; Oracle rates it critical at CVSS 10.0.

In Oracle Fusion Middleware, the largest cluster is in Oracle SOA Suite. CVE-2026-91216 and CVE-2026-91221 affect the Fabric Layer in 12.2.1.4.0 and 14.1.2.0.0; both are unauthenticated over T3 or IIOP and score 10.0. CVE-2026-91231 affects the Adapters component over HTTP with the same unauthenticated takeover result. Several additional SOA Suite entries are low-privileged but critical at 9.9, including CVE-2026-91224, CVE-2026-91232 and CVE-2026-91250.

CVE-2026-87337 in Oracle Access Manager is an unauthenticated HTTP flaw in versions 12.2.1.4.0 and 14.1.2.1.0; it allows complete access to and modification of OAM data. CVE-2026-101499 in Oracle WebCenter Sites has CWE-287 and CWE-306 references, affects versions 12.2.1.4.0 and 14.1.2.0.0, and carries a 9.8 score with takeover potential. CVE-2026-91354 in Oracle Outside In Technology 8.5.8 is a low-privileged network flaw but still critical at 9.9. CVE-2026-91222 in Oracle Business Process Management Suite is also low-privileged, reachable over SOAP, and scores 9.9.

Patch in this order

1. Patch Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 first. CVE-2026-91216, CVE-2026-91221 and CVE-2026-91231 are unauthenticated, network-reachable and score 10.0 with full takeover.

1. Patch Oracle E-Business Suite Workflow 12.2.3 through 12.2.15. CVE-2026-101809 is an unauthenticated HTTP path to takeover of Workflow.

1. Update Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0. CVE-2026-87337 allows an unauthenticated HTTP attacker to read and modify OAM data.

1. Update Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0. CVE-2026-101499 is unauthenticated and rated 9.8.

1. Then address the lower-privilege critical flaws - Oracle Business Process Management Suite CVE-2026-91222 and Oracle Outside In Technology CVE-2026-91354 - before working through the remaining Fusion Middleware, E-Business Suite, Java SE and Database Server CVEs according to network exposure.

Beyond the patch

A release of this scale is easier to absorb if you already know where Oracle SOA Suite, Access Manager, Workflow and WebCenter Sites are reachable from the network. Virtual CISO Services (vCISO) keeps that exposure picture current and prioritises the unauthenticated services this CPU targets, while Implementation & Assessment Services can validate the authentication paths and middleware configurations these flaws touch before and after patching. Supply Chain Defense & Third-Party Risk tracks Oracle's patch cadence against the products you rely on, so the next Critical Patch Update does not arrive as a surprise.