Oracle has rolled out its October 2026 Critical Patch Update, addressing 1,295 security vulnerabilities across a wide array of products. Notably, this update fixes 1,209 unique Common Vulnerabilities and Exposures (CVEs), with 95 classified as critical. A deep dive by Tenable reveals that 439 of these CVEs have been rated as high severity, while 582 are considered medium severity. Oracle Fusion Middleware is the recipient of the most patches, with 206 fixes, 134 of which can be exploited remotely without requiring user authentication. Other significant updates have been made to Oracle’s E-Business Suite, Siebel CRM, and various other Oracle products, such as MySQL and Java SE.

Despite the extensive list of vulnerabilities addressed, Oracle reports that none have been exploited in the wild. However, the company remains vigilant, reminding customers that it occasionally receives reports of exploitation attempts targeting its software. In a related advisory, Oracle responded to the eMudhra weak-key incident affecting Java, issuing a specific alert for CVE-2026-91403. Looking ahead, Oracle has scheduled its next set of Critical Security Patch Updates for November 17 and December 15, with the following CPU planned for January 19, 2027. These updates are crucial for maintaining the security and integrity of Oracle's vast suite of products.