Oracle released its October 2026 Critical Patch Update (CPU) on 20 October, delivering 1,295 new security patches across its enterprise product portfolio. The update covers Oracle Database Server, E-Business Suite, APEX, Fusion Middleware, Java SE, MySQL, Oracle Communications, Siebel CRM and several other product families.
For organisations operating Oracle technologies, the challenge is not simply the number of patches. It is identifying which vulnerabilities affect their deployed products, understanding the exploitation requirements and prioritising fixes based on business impact.
Oracle recommends applying security updates without delay and maintaining actively supported product versions.
What stands out in this release?
The October CPU addresses vulnerabilities across a broad range of enterprise technologies, including database platforms, business applications, middleware and communications systems.
Some vulnerabilities may be exploited remotely, while others require specific privileges or access to particular network services. These differences matter when deciding which systems should be patched first.
Oracle’s detailed risk matrices provide the CVE identifiers, affected versions, CVSS scores and exploitation conditions needed to assess individual vulnerabilities.
Notable CVEs in Oracle Database Server
CVE-2026-75803 — CVSS 9.8
This vulnerability affects the OpenSSL component within Oracle Database Server. According to Oracle, an unauthenticated attacker with network access over TLS could exploit the flaw to compromise the affected component.
The listed affected versions are 19.3–19.32 and 23.4.0–23.26.3.
Oracle states that successful exploitation could result in a takeover of the affected component. This makes it a high-priority finding for organisations running the affected versions.
CVE-2026-91499 — CVSS 8.8
This vulnerability affects the RDBMS component in Oracle Database Server versions 23.4.0–23.26.3.
Exploitation requires a low-privileged attacker with the DBMS_VECTOR privilege and network access through Oracle Net. Successful exploitation could result in a database takeover.
Although the score is below 9.0, the potential impact makes this vulnerability important for organisations using the affected functionality.
CVE-2026-91503 — CVSS 8.1
This vulnerability affects the Virtual Private Database (VPD) component in Oracle Database Server versions 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3.
A low-privileged attacker with the CREATE TABLE privilege and Oracle Net access could exploit the issue. Successful exploitation could enable unauthorised access to, or modification of, sensitive data.
Database teams should assess the applicable privileges and affected versions as part of remediation planning.
CVE-2026-91563 — CVSS 8.8
This vulnerability affects the Oracle OLAP component in Oracle Database Server versions 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3.
Exploitation requires a low-privileged attacker with the DBMS_AW privilege and Oracle Net access. Oracle identifies potential takeover of the affected OLAP component as an outcome of successful exploitation.
CVE-2026-93569 — CVSS 8.2
This vulnerability affects the Micronaut component within Oracle Database Server versions 19.3–19.32 and 23.4.0–23.26.3.
Oracle states that an unauthenticated attacker with HTTP network access could exploit the flaw, potentially enabling unauthorised data access and modification.
The absence of an authentication requirement makes exposure assessment particularly important for affected deployments.
These CVEs are selected examples from Oracle’s official Database Server risk matrix, not the complete list of database vulnerabilities addressed by the October update.
Other product families to review
Oracle E-Business Suite
Oracle E-Business Suite receives 196 new security patches. Oracle’s product summary identifies vulnerabilities with a maximum CVSS v3.1 score of 10.0, including issues that may be remotely exploitable without authentication.
Organisations should review the E-Business Suite risk matrix against their deployed modules and versions, with particular attention to internet-facing applications and business-critical workflows.
Oracle APEX
Oracle APEX receives two new security patches. Both address vulnerabilities that Oracle identifies as potentially remotely exploitable without authentication. The maximum CVSS v3.1 score for this product family is 9.8.
Teams operating APEX applications should verify their installed versions against Oracle’s affected-version list.
Oracle Java SE
The October CPU includes 55 new security patches for Oracle Java SE. Oracle reports that 49 address vulnerabilities that may be remotely exploitable without authentication. The highest CVSS v3.1 score for this product family is 7.5.
Java installations can exist in application servers, development systems and embedded environments. Asset discovery should cover these locations rather than focusing only on centrally managed production servers.
Oracle Communications
Oracle Communications receives 124 new security patches, including 87 addressing vulnerabilities that may be remotely exploitable without authentication. The highest CVSS v3.1 score for this product family is 9.8.
Organisations using these platforms should assess affected components, network exposure and the availability of applicable fixes.
Oracle Siebel CRM
Oracle Siebel CRM receives 123 new security patches, with a maximum CVSS v3.1 score of 9.9.
Because CRM systems can hold sensitive customer and business information, teams should identify affected deployments and prioritise the applicable fixes according to exposure and business impact.
The figures above are product-level summaries. They should not be interpreted as evidence that every vulnerability in a product family is remotely exploitable or actively being exploited.
Recommended security actions
1. Inventory: Identify Oracle products, versions and exposed services across production, development, cloud and legacy environments.
2. Prioritise: Start with applicable vulnerabilities rated CVSS 9.0–10.0, especially those affecting remotely accessible systems. Include lower-scored vulnerabilities where the potential impact is significant.
3. Patch: Apply Oracle’s prescribed security updates for the relevant product and supported version, following the installation instructions.
4. Verify: Confirm the installed patch level, document exceptions and track systems that remain vulnerable.
5. Investigate: Review relevant logs and investigate suspicious activity where exposure or other evidence indicates a possible compromise.
Final thoughts
Oracle’s October 2026 CPU is a broad enterprise security release, with important findings across Database Server, E-Business Suite, APEX, Java SE, Communications and Siebel CRM.
The practical priority is to map the advisory to the actual environment. A vulnerability’s CVSS score is useful, but the affected product, network exposure, privileges required for exploitation and business impact should all influence remediation order.
Security teams should use Oracle’s official risk matrices to build a complete product-specific CVE inventory rather than relying on a handful of highlighted vulnerabilities.
Official references
- Oracle October 2026 Critical Patch Update
- Detailed October 2026 CVE risk matrices
- Oracle CVE-to-advisory mapping
