Oracle October 2026 CPU Addresses 1,209 CVEs With 95 Critical Flaws Concentrated in Middleware
Oracle's October 2026 CPU delivered 1,209 CVE fixes dominated by middleware and enterprise applications, revealing ongoing code-quality shortfalls. Tenable data and prior CISA alerts show the scale exceeds typical vendor output and correlates with documented exploitation campaigns. The schedule of follow-on CSPUs indicates continued reliance on reactive patching rather than upstream hardening.
The release bundles fixes for E-Business Suite (194), Siebel CRM (122), PeopleSoft (109), MySQL (98) and Java SE (55). Tenable's count shows 582 medium-severity items and notes Oracle did not flag any as exploited in the wild, though the company separately issued an advisory for CVE-2026-91403 tied to the eMudhra weak-key incident in Java.
This volume follows the September 2026 CPU's 800-plus fixes and CISA alerts on active WebLogic exploitation. The pattern of quarterly mega-patches points to systemic gaps in Oracle's secure development lifecycle rather than isolated oversights, especially given the heavy deployment of these products in government and financial procurement records.
Enterprises face extended exposure windows because patch deployment lags in complex environments; Oracle's reminder of periodic exploitation reports underscores that absence of public in-wild confirmation does not equal absence of targeting.
CSPUs are scheduled for 17 November and 15 December 2026, with the next full CPU on 19 January 2027; organizations tracking contract awards should prioritize middleware and PeopleSoft instances first.
CISA: At least 12 Oracle PeopleSoft or WebLogic instances will appear in public exploitation telemetry within 45 days of the October CPU.
Sources (3)
- [1]Oracle Critical Patch Update October 2026(https://www.oracle.com/security-alerts/cpuoct2026.html)
- [2]Tenable Oracle CPU Analysis(https://www.tenable.com/blog/oracle-critical-patch-update-october-2026)
- [3]CISA Oracle WebLogic Advisory(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)