Key points
- Oracle released 1295 security updates for 1209 unique CVEs in its October 2026 Critical Patch Update.
- One hundred twelve issues were rated critical severity, representing 8.6% of the total patches.
- Oracle Fusion Middleware had the highest patch count at 206, followed by E-Business Suite.
The October 2026 Critical Patch Update from Oracle addresses 1209 unique CVEs through 1295 security updates. This release is the final quarterly patch cycle for the year, released on October 20 according to Tenable research. The update spans 33 Oracle product families, providing fixes for a wide range of vulnerabilities. Security teams must review their environments to determine which specific products require immediate attention based on the published advisory.
In plain English
This patch cycle contains a mix of severity ratings, with medium severity issues making up the largest portion at 47.3% of all patches. High severity patches account for 36.7% of the updates. Critical severity patches represent 8.6% of the total, covering 112 specific issues across 95 CVEs. Low severity patches make up the remaining 95 updates. Understanding this distribution helps prioritize remediation efforts, focusing on the most severe threats first while tracking the volume of lower-severity fixes that still require application.
The background
Tenable’s analysis shows that Oracle Fusion Middleware received the highest number of patches in this cycle, totaling 206 updates. This accounts for 15.9% of all patches released in the October CPU. Oracle E-Business Suite followed closely with 194 patches, representing 15% of the total. The remaining product families share the balance of the 1295 updates. The advisory includes a breakdown of vulnerabilities that can be exploited over a network without authentication, highlighting the immediate risk profile for exposed systems.
What changes now
Oracle advises customers to apply all relevant patches included in this Critical Patch Update. The company released the advisory on October 20, marking the end of the 2026 patching calendar. Tenable notes that plugins to identify these specific vulnerabilities will be added to their detection suite as they are developed. Organizations should monitor the October 2026 advisory for full details on which CVEs affect their specific product versions and configurations.
Who needs to act first
Teams should prioritize systems that are directly accessible from external networks or untrusted internal segments. Begin by updating components with critical severity ratings, as these pose the most immediate risk. Test patches in isolated environments before deploying to production to ensure stability. Back up critical data and configurations prior to applying updates. If a system cannot be patched immediately, isolate it from the network to reduce exposure.
What to do and how to stay safe: Oracle
- Inventory all Oracle products in your environment to identify which ones are covered by the October 2026 CPU.
- Check your vulnerability scanner reports for any of the 1209 CVEs mentioned in the advisory.
- Apply the critical severity patches first, then schedule high and medium severity updates.
- Monitor for new detection plugins from Tenable to verify your patching status.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many critical severity issues are in the October 2026 CPU?
There are 112 critical severity patches addressing 95 CVEs in this update.
Which Oracle product family has the most patches?
Oracle Fusion Middleware has the highest count with 206 patches.
When was this patch update released?
Oracle released the October 2026 Critical Patch Update on October 20.
