Oracle Ships 1,295 Security Patches in October CPU

Oracle has released 1,295 new security patches in its quarterly Critical Patch Update for October, covering software from its Fusion Middleware stack to MySQL and Java. The advisory, first published on 20 October, does not say that any of the flaws are being exploited.

The headline figure is a patch count. Oracle’s advisory states that the update “contains 1295 new security patches”, and it reports each product family’s total the same way. That is not the same as a count of distinct vulnerabilities, and coverage that treats the two as one can differ: SecurityWeek headlines its story as “over 1,200 vulnerabilities”. The advisory also lists only patches added since the last quarterly update, since Oracle’s patches are “usually cumulative”.

Where the patches landed

Fusion Middleware, Oracle’s suite of application servers and integration software, took the largest share with 206 new patches. Oracle says 134 of them address flaws that “may be remotely exploitable without authentication”, meaning over a network without user credentials. E-Business Suite was next with 194, of which 31 fall into that category.

Product family	New patches	Remotely exploitable without authentication
Fusion Middleware	206	134
E-Business Suite	194	31
Siebel CRM	122	66
Communications	110	77
PeopleSoft	109	41
JD Edwards	102	44
MySQL	98	29
Java SE	55	49

Source: Oracle Critical Patch Update Advisory, October 2026

The proportions vary widely. Nearly nine in ten of the Java SE patches (49 of 55) and seven in ten of the Communications patches (77 of 110) are for flaws Oracle says can be reached without credentials, compared with about one in six for E-Business Suite. Further down the list, Supply Chain received 50 patches (19 remotely exploitable without authentication) and Analytics 33 (14).

Oracle Database Products received 126 patches in total, but most went to related tools such as Essbase (38) and REST Data Services (35). The core Oracle Database Server got 14, four of which Oracle says may be remotely exploitable without authentication.

Oracle scores each flaw using version 3.1 of the Common Vulnerability Scoring System. Six entries in this quarter’s risk matrices carry the maximum base score of 10.0, all of them remotely exploitable without authentication: three in Oracle SOA Suite, one in Oracle Access Manager, one in E-Business Suite’s workflow notification mailer and one in the JD Edwards EnterpriseOne Orchestrator. Oracle’s scoring for these entries describes attacks over a network with low complexity, needing no privileges and no user interaction. Two of the SOA Suite entries are listed against the T3 and IIOP protocols; the other four are reached over HTTP. The advisory lists SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 as affected by those two. Across the whole release, nearly 100 vulnerabilities are rated critical, according to SecurityWeek, which cites an analysis by security firm Tenable.

Patched flaws, not zero-days

None of the flaws is described as a zero-day. SecurityWeek notes that Oracle “has not flagged any of these vulnerabilities as exploited in the wild”.

Oracle’s own warning is about flaws it has already fixed. The company says it “continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches”, and that “in some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches”. It “strongly recommends that customers remain on actively-supported versions and apply security patches without delay”.

By Oracle’s own counts, the product families at the top of the table are where the largest numbers of flaws reachable without a login sit. Oracle publishes its risk matrices in English text and machine-readable CSAF JSON formats alongside the advisory, along with a map of CVEs to advisories, for administrators working out what applies to them. SAP’s October patch day last week likewise included a maximum-severity fix.

Oracle has set its next dates. Smaller Critical Security Patch Updates are scheduled for 17 November and 15 December, and the next full Critical Patch Update is due on 19 January 2027.