Oracle’s quarterly Critical Patch Update for October 2026 is due today, and its pre-release notice lists 1,283 new security patches, with CVSS 10.0 flaws in E-Business Suite, Fusion Middleware and JD Edwards. UK organisations running Oracle ERP, middleware or MySQL should have a ranked patch queue ready before the full advisory and its CVE details go public.
What happened
Oracle publishes its Critical Patch Updates (CPUs) every quarter, and October’s is scheduled for Tuesday 20 October 2026. Ahead of the release, Oracle published a pre-release announcement setting out the scale: 1,283 new security patches across more than 30 product families. At our last check on Tuesday evening, UK time, Oracle’s page still showed only the pre-release notice; the full advisory with CVE identifiers and risk matrices had not appeared. All figures below come from Oracle’s pre-release notice, and Oracle warns they may change before the final advisory is published.
Oracle’s own wording is blunt. Because of the threat posed by a successful attack, the company says it “strongly recommends” applying the patches as soon as possible. None of the sources reviewed for this article report active exploitation of any flaw in this update, and Oracle’s pre-release notice does not mention it. Patch watcher MoonSec noted that no CVE IDs or CISA Known Exploited Vulnerabilities status had been published for the update when it last checked.
The technical picture
The headline number covers an uneven spread of risk. Three product families carry the maximum CVSS v3.1 base score of 10.0:
- Oracle E-Business Suite: 196 new patches for versions 12.2.3 to 12.2.15, with 34 flaws that may be exploitable over a network without credentials.
- Oracle Fusion Middleware: another 196 patches, 132 of them potentially exploitable remotely without authentication. The affected list takes in WebLogic Server, Oracle HTTP Server, Access Manager, Identity Manager, SOA Suite, Service Bus, Managed File Transfer and the WebCenter products.
- JD Edwards EnterpriseOne: 102 patches, 44 of them potentially exploitable remotely without authentication, including Tools and Orchestrator up to 9.2.26.5.
Several other families come close. Siebel CRM has 123 patches (67 unauthenticated remote) with a top score of 9.9. Essbase, Enterprise Manager and Trusted Answer Search also top out at 9.9. PeopleSoft has 109 patches with a highest score of 9.8, and PeopleTools 8.61 to 8.63 is affected. MySQL accounts for 98 patches, 29 of them reachable without credentials, across Server, Client, Router, Cluster and Enterprise Backup. Oracle Communications has 124, of which 87 may be exploitable without authentication.
Java SE gets 55 patches, and 49 of them could be triggered remotely without credentials. The highest Java score is 7.5, but Java turns up in almost every estate. The core Database Server is relatively light this quarter, with 13 patches and a top score of 8.8, covering 19c, 21c and the 23 series. APEX, Secure Backup, Autonomous Health Framework and Oracle Systems (Solaris and the ZFS Storage Appliance Kit) each top out at 9.8.
The phrase “remotely exploitable without authentication” is the one to watch. It means Oracle believes an attacker could reach the flaw over a network without valid credentials. Combined with a critical score, that usually points to internet-facing login portals, web tiers and integration endpoints.
Why it matters for UK organisations
Oracle’s business applications and middleware sit deep in UK infrastructure. Finance and HR teams in central and local government, universities, the NHS supply chain, utilities, retailers and manufacturers run E-Business Suite, PeopleSoft, JD Edwards and Siebel. WebLogic and Oracle HTTP Server frequently front these systems, and some deployments are exposed to the internet for suppliers, students or remote staff.
The other UK problem is indirect exposure. As the aboutinfosec guidance points out, Oracle components are often embedded in third-party products and managed services. A UK organisation may not think of itself as an Oracle customer and still run vulnerable WebLogic, Java or MySQL inside a vendor’s appliance or hosted platform. Under UK GDPR, and under the incoming Cyber Security and Resilience Bill for in-scope service providers, “our supplier hadn’t patched” will not hold up well with a regulator after a breach.
Timing matters too. Once the final advisory is out, researchers and attackers can compare patched and unpatched code. Critical flaws in widely deployed enterprise software tend to draw scanning soon after disclosure, so the useful window for patching internet-facing systems is short.
Expert view
In my experience, Oracle CPU day is where good vulnerability management programmes separate from struggling ones. The organisations that cope well treat the pre-release notice as an early warning. They know which E-Business Suite instance is internet-facing, which WebLogic domains sit behind it and who owns each one. The ones that struggle open a single ticket called “Oracle October patches” and then spend three weeks working out what they run.
When we test Oracle-heavy estates, the weak point is rarely the database itself. It is the web tier, the forgotten integration server, or a test copy of EBS cloned from production years ago and still holding live data. That is why I care less about the 1,283 figure than about the 132 unauthenticated remote flaws in Fusion Middleware.
I would also be cautious about vendor “reviewing the CPU” statements. If a supplier embeds WebLogic or Java in a product you depend on, ask for a dated fix commitment and an interim mitigation in writing. Finally, a patch closes the hole but does not tell you whether someone came through it first. For exposed systems, gather logs and configuration baselines before you patch, so that you can still investigate later if needed.
What to do now
- Map exposure today. Match every product family in the pre-release notice against your asset inventory, CMDB and cloud accounts, including Oracle components inside third-party software. This is the Cyber Essentials secure configuration and asset management groundwork.
- Prioritise unauthenticated, internet-facing systems. Put E-Business Suite, WebLogic, Oracle HTTP Server, Access Manager, Identity Manager and JD Edwards endpoints reachable from the internet in the first patch ring.
- Restrict access while you wait. Where patching will take days, limit administrative consoles and non-essential services to trusted networks using firewall rules, in line with the Cyber Essentials boundary firewall control.
- Patch inside the 14-day window. Cyber Essentials requires critical and high-risk updates to be applied within 14 days of release. Plan maintenance slots now for EBS, PeopleSoft, MySQL and Java fleets, with separate owners and test plans for each.
- Chase your suppliers. Ask managed service providers and software vendors which Oracle components they embed, whether this CPU applies and when fixes will ship.
- Capture baselines first. On exposed systems, save logs, account lists and configuration before patching, and check for unexplained changes.
- Re-check the final advisory. When Oracle publishes CVE IDs and risk matrices, update your queue, because the final figures may differ from the pre-release notice.
Bottom line
October’s Oracle update is large, but the real priority is the few hundred flaws that Oracle says may be exploitable over a network without a login, especially on internet-facing systems. UK organisations that already know where their E-Business Suite, WebLogic and JD Edwards instances sit should be patching this week. Those that do not should start with that inventory before the CVE details are published.
