Oracle's quarterly security release, issued Oct. 20, contains 1,295 fixes across its business software, databases and Java, SecurityWeek reported Thursday. Oracle has not flagged any of the flaws as exploited in the wild, but the volume lands on teams that run the company's finance, HR and middleware systems, which attackers have targeted repeatedly.
What Happened
The October Critical Patch Update, Oracle's scheduled quarterly bundle, addresses 1,209 unique vulnerabilities across 33 product families, according to an analysis by security firm Tenable, which sells vulnerability management tools. Each vulnerability carries a CVE, or Common Vulnerabilities and Exposures, identifier; some are fixed in more than one product, so patches outnumber CVEs.
By Tenable's count, 95 CVEs are rated critical, 439 high and 582 medium. Fusion Middleware, the software layer that connects Oracle applications and often faces the internet, has the most patches at 206. E-Business Suite follows with 194, then Siebel CRM with 122, Communications with 110, PeopleSoft with 109, JD Edwards with 102, MySQL with 98 and Java SE with 55.
The figure that matters most is how many flaws can be attacked remotely without logging in. Tenable puts that at 134 in Fusion Middleware, 77 in Communications, 66 in Siebel CRM, 49 in Java SE and 44 in JD Edwards.
Oracle has not marked any of the vulnerabilities as exploited, though it says it periodically receives reports of attempts to exploit its products, SecurityWeek reported. A day after the quarterly release, Oracle issued a separate Java alert, CVE-2026-91403, covering its response to the eMudhra weak-key certificate incident.
Why It Matters
Oracle's ERP suites, middleware and Java runtime sit underneath payroll, procurement and customer records at many large organizations. A flaw that needs no password lets an outsider who can reach the system attack it directly, without first stealing an employee's credentials.
The risk is not theoretical. Google said last month that the ShinyHunters extortion group was again exploiting an Oracle PeopleSoft flaw, The Primary Wire reported, citing SecurityWeek. Executives should ask whether internet-facing Fusion Middleware and E-Business Suite systems are patched first, and how long the rest will take.
Context
Tenable describes this release as the final quarterly update of the year. Oracle now also issues monthly Critical Security Patch Updates between quarterly bundles, which SecurityWeek says arrive on the third Tuesday of each month. More frequent updates shorten the wait for fixes but give patch teams less time between cycles.
What to Watch
Oracle's next monthly update is due Nov. 17, followed by Dec. 15; the next quarterly bundle is scheduled for Jan. 19, 2027. Watch for public exploit code against Fusion Middleware and E-Business Suite flaws and for any additions to the U.S. Cybersecurity and Infrastructure Security Agency's catalog of known exploited vulnerabilities, which would set federal patch deadlines.
