Oracle administrators have more than a thousand vulnerabilities to assess this week, and six carry the highest possible CVSS score of 10.0. The fixes cover software used for authentication, finance, databases, and other critical operations.
Released on Oct. 20, Oracle’s quarterly Critical Patch Update contains 1,295 security patches addressing 1,209 unique CVEs across 33 product families, according to Tenable’s analysis. Several maximum-severity flaws may be exploited remotely without authentication. Security teams need to identify affected deployments, particularly services reachable from untrusted networks.
Six CVSS 10.0 flaws affect key enterprise systems
Oracle's official risk matrices identify six maximum-severity vulnerabilities, all potentially exploitable remotely without authentication. They affect four sets of enterprise software.
| Oracle product | CVE identifiers |
|---|---|
| E-Business Suite Workflow Notification Mailer | CVE-2026-101809 |
| Oracle Access Manager | CVE-2026-87337 |
| Oracle SOA Suite | CVE-2026-91231, CVE-2026-91216, CVE-2026-91221 |
| JD Edwards EnterpriseOne Orchestrator | CVE-2026-91299 |
Oracle lists affected E-Business Suite versions 12.2.3 through 12.2.15, Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0, and JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5.
The Access Manager and SOA adapters issues use HTTP, while two SOA Fabric Layer flaws involve T3 and IIOP. Potential unauthenticated exploitation does not establish that attacks have occurred. The advisory does not confirm active exploitation of these six CVEs.
Fusion Middleware accounts for the most fixes
Tenable counted 112 critical patches covering 95 unique CVEs. Oracle Fusion Middleware received 206 patches, including 134 potentially exploitable remotely without authentication. E-Business Suite followed with 194 patches, Siebel CRM 122, Communications 110, PeopleSoft 109, and JD Edwards 102.
Patch and vulnerability counts differ because one CVE can require fixes in multiple Oracle products. Companies using several product families may need different updates to address the same underlying issue. Oracle’s earlier patch release covering 943 vulnerabilities provides additional context for the recurring patch workload.
How security teams should prioritize Oracle patches
Oracle urged customers to install the October updates promptly and use its product-specific patch guidance.
Administrators should prioritize affected systems based on severity, network exposure, and business impact, then coordinate testing and deployment across application owners. Internal systems also need assessment: restricting internet access does not remove every route to exploitation.
E-Business Suite administrators should check the underlying Oracle Database and Fusion Middleware components separately. Oracle says their security updates are not included in the E-Business Suite risk matrix, so reviewing that matrix alone can leave relevant fixes overlooked.
- Identify exposed assets: Inventory Oracle products and versions, including vendor-managed systems. Match them against Oracle’s risk matrices and flag internet-facing authentication, workflow, and application services. Previous Oracle SQL injection attacks enabling remote code execution provide additional context for assessing exposed applications.
- Limit access while patching: Prioritize vulnerable HTTP, T3, and IIOP endpoints. Restrict unnecessary network exposure, coordinate maintenance windows, and prepare backup and rollback procedures before installing updates.
- Confirm remediation: Verify installed patch levels, test essential business functions, rescan where appropriate, and track unresolved exceptions with assigned owners and target dates.
Businesses that outsource Oracle administration should request evidence of patch deployment, not simply a vendor assurance that updates are scheduled. Where an immediate fix is impractical, document temporary access controls and a firm review date. Earlier PeopleSoft attacks that bypassed web application firewall rules illustrate why compensating controls need validation and cannot replace the underlying patch. Security teams should also check relevant logs for unusual activity without assuming exploitation has occurred.
Also read: For a recent example of why ownership and verification matter, see how an unpatched Oracle PeopleSoft system figured in an FBI-related ShinyHunters breach.