Oracle Critical Patch Update October 2026: 1,295 security fixes

Oracle’s October 2026 Critical Patch Update contains 1,295 new security fixes across Oracle products and third-party components. The release covers Oracle Database, MySQL, Fusion Middleware and WebLogic, E-Business Suite, Java, PeopleSoft, JD Edwards, Siebel, VirtualBox, Solaris and sector-specific platforms.

The figure of 1,295 attracts attention but does not set a useful rollout order by itself. Organisations need to combine their product inventory with network exposure, process criticality and dependency data. Oracle notes that successful attacks have repeatedly affected customers who did not apply previously available updates and strongly recommends prompt patching of supported releases.

The priority action: do not assign the entire CPU as a single generic Oracle administration task. Build a product and component inventory, assign owners, identify remotely exploitable issues that require no authentication, then plan testing and rollout of the complete set of dependent patches.

What is included in the Oracle Critical Patch Update for October 2026?

The October bulletin divides updates across dozens of product families. Some of the largest groups are:

• Oracle Fusion Middleware — 206 new security patches, including 134 for vulnerabilities that may be remotely exploitable without authentication;
• Oracle E-Business Suite — 194 new security patches, including 31 unauthenticated remote scenarios;
• Oracle MySQL — 98 new security patches, 29 of which may be exploited remotely without credentials;
• Oracle Database — 14 new security patches plus third-party component updates, with four remotely exploitable without authentication.

These are only part of the release. CERT-In advisory CIAD-2026-0051 also lists Enterprise Manager, Java SE, JavaFX, GraalVM, PeopleSoft, JD Edwards, Siebel, Analytics, GoldenGate, ORDS, NoSQL Database, Solaris, VirtualBox, healthcare and hospitality applications, and other products.

A large patch count does not mean 1,295 separate crises in every company. It does mean that manually chasing individual CVEs without a reliable inventory will be inefficient and may miss important dependencies.

Oracle Database, MySQL, WebLogic and EBS: where to start

Internet-accessible systems

Give highest priority to components that accept traffic from untrusted networks: public applications running WebLogic or other Fusion Middleware, partner-facing EBS interfaces, API gateways, portals and exposed database services. Combine vulnerability data with firewall, reverse-proxy, VPN and supplier-access information.

Products with unauthenticated attack paths

An attack that needs no account shortens the adversary’s path. That does not mean every such issue is reachable in a given architecture. Validate the protocol, port, component and configuration, and record the result. The number of fixes in Fusion Middleware and EBS warrants a dedicated review, not automatic risk acceptance because a database is described as “internal”.

Systems supporting critical business processes

ERP, finance, HR, procurement, production and customer data may require longer testing, but that importance must not result in indefinite deferral. The harder a system is to patch, the earlier the process should begin: prepare a test environment, backups, recovery plan and maintenance window.

Critical Oracle E-Business Suite dependencies

Oracle explicitly says that E-Business Suite depends on Oracle Database and Fusion Middleware components. Secure EBS maintenance therefore requires more than patches carrying the E-Business Suite label; the corresponding database and middleware updates must also be applied.

This often becomes an ownership problem. EBS, Database, WebLogic, the operating system and infrastructure may belong to several teams or suppliers. Each party sees one layer and nobody owns the complete path. Assign one business owner, maintain a shared plan and capture the installed version of every layer after the change.

An organisational Oracle CPU rollout plan

1. Map products to the bulletin

Collect exact versions from the CMDB, consoles, scanners, licence records and application teams. The October CPU includes Oracle Database 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3, as well as E-Business Suite 12.2.3–12.2.15. A product name without its version is not enough.

2. Order work by real risk

Assess unauthenticated exploitability, exposure, data sensitivity, supplier access and existing controls. Use a repeatable critical-vulnerability prioritisation process rather than a queue based only on CVSS.

3. Test the complete stack

Verify backups, application compatibility, drivers, integrations, batch jobs, reports and authentication. Include Database and middleware for EBS. For clusters and high-availability platforms, define node order and criteria for stopping the change.

4. Reduce exposure before the maintenance window

Remove unnecessary public access, limit connections to trusted networks, enforce MFA on administrative paths, update monitoring rules and watch for unusual errors. Virtual patching or WAF controls can help, but they do not replace the vendor update.

5. Confirm results and close exceptions

After deployment, record component versions, test results, completion time and deferred systems. Every exception needs an owner, rationale, temporary controls and a date for the next decision. “No maintenance window” without a date is not a plan.

What executives and business owners need to know

An Oracle CPU is not purely technical work. It requires decisions about availability, outage risk and testing resources. A business owner should receive a concise view: affected processes, externally accessible systems, installation date and residual risk after temporary controls.

Teams should not present 1,295 rows as an executive report. A more useful view separates products not used, patches completed, scheduled, temporarily excepted and awaiting an urgent decision. That supports risk management rather than CVE counting.

Source facts and Breachroad conclusions

Oracle confirms 1,295 new security patches, product-family totals, affected release ranges and its recommendation for prompt installation. It also identifies EBS dependencies on Database and Fusion Middleware updates. CERT-In confirms the broad product scope and advises applying the vendor fixes.

The prioritisation model, single ownership for the complete EBS stack, executive reporting format and exception rules are Breachroad recommendations. System owners can practise these decisions through cybersecurity training for organisations, while an IT security audit can establish the actual patch state.

Oracle Critical Patch Update October 2026 FAQ

How many fixes are in the October 2026 Oracle CPU?

The bulletin contains 1,295 new security patches across Oracle products and third-party components. An individual organisation needs the updates matching its products, versions and dependencies.

Does the Oracle CPU cover only databases?

No. It includes MySQL, Fusion Middleware and WebLogic, E-Business Suite, Java, PeopleSoft, JD Edwards, Siebel, VirtualBox, Solaris and many sector-specific applications.

Can we install only the E-Business Suite patches?

Not necessarily. Oracle states that EBS relies on Oracle Database and Fusion Middleware, so the appropriate updates for those components must also be installed.

What should be patched first?

Start with internet-accessible systems, vulnerabilities exploitable without authentication and platforms supporting critical processes or many applications. The final order must reflect the organisation’s real architecture.

Primary sources: Oracle — Critical Patch Update, October 2026, CERT-In — CIAD-2026-0051.