The Oracle critical patch update released October 20 is unusually large, with 1,295 security patches covering 1,209 unique CVEs. One of the six CVSS 10.0 flaws in the bundle can be hit without logging in, which moves it to the top of the patch list.

What the Oracle critical patch update includes

Oracle published the update on October 20, and the Oracle E-Business Suite blog confirms the release date. According to SecurityWeek's analysis, the patches span 33 product families. Other coverage describes this release as the final scheduled quarterly update of 2026, which helps explain why the bundle is so large.

Fusion Middleware received the most patches, at 206. E-Business Suite followed with 194 patches, all affecting versions 12.2.3 through 12.2.15 [7]. Oracle Database, Java SE, MySQL, PeopleSoft and Siebel CRM are also in the primary exposure group for US companies and agencies [6][7].

Those products rarely sit at the edge. Oracle databases, E-Business Suite and middleware run inside many US finance, HR, healthcare and government back offices. That placement is why security teams should treat this release as a patch-now item rather than routine maintenance.

Severity is spread across the scale. Medium-rated patches make up 47.3% of the release and high-rated patches 36.7% [7], so the bundle is not only a story about the most dangerous items.

Individuals are mostly affected indirectly. You are exposed only if your employer, your bank or another service you use runs an Oracle-powered system.

Six CVSS 10.0 flaws and the E-Business Suite bug to patch first

Six flaws carry the maximum CVSS score of 10.0 [3][5]. The most urgent is CVE-2026-101809, a flaw in the Workflow Notification Mailer component of E-Business Suite versions 12.2.3 through 12.2.15. It can be exploited over HTTP without authentication and can lead to takeover of the Workflow component [5][6].

The access requirement is what sets this bug apart. An attacker does not need a valid account to reach the vulnerable component, so exposure depends mainly on whether the Workflow mailer can be reached from networks outsiders can touch. Internet-facing E-Business Suite deployments should be first in line.

This article did not review Oracle's full advisory text directly. Pull the complete list of six CVSS 10.0 entries from Oracle before you triage, rather than relying on summaries.

Are Oracle flaws being exploited right now?

Not confirmed. Oracle's release does not establish that CVE-2026-101809 is being exploited in the wild [6]. A separate Oracle warning about attacks on unpatched customers exists, but cyberupdates365 advises against reading it as incident-specific evidence [6].

No confirmed exploitation is not a reason to wait. Ransomware crews have already used a Palo Alto PAN-OS flaw to reach domain credentials, as our earlier reporting shows. Attackers who find an exposed enterprise service tend to move quickly from initial access to the accounts that run the network.

Watch CISA's Known Exploited Vulnerabilities catalog. A listing for any item in this CPU would move it from scheduled work to an emergency.

Why the critical counts and remote exploit totals do not match

Reports disagree on how many flaws are critical. Tenable's analysis, as reported by SecurityWeek and CloudLink, puts the critical total at 95 CVEs [1][8]. Breach Signal and cyberupdates365 report 112 critical patches, or 8.6% of the total [7][6].

Units explain part of the gap. The 1,295 figure counts patch entries, not separate vulnerabilities [6], so compare counts only within the same unit.

Remote exploitation counts also differ. Fortra counts 519 unique CVEs that can be exploited remotely without credentials [4], while another analysis reports 562 risk-matrix entries [7]. Until Oracle's own advisory settles the question, plan around the larger number.

Why this patch release lands in a crowded week

CNBC framed the week as "Black October," driven by critical PHP flaws that AI tools helped surface [10]. TechCrunch reported that government websites went offline as those warnings spread [9]. Our earlier reporting on PHP2Shell describes how that flaw was exploited before patches were available, which is one reason patch queues are under strain.

Brian Krebs, as CNBC quoted him, said: "This is a significant week or two in cybersecurity." [10] That view matches the pressure many security teams describe this week.

A separate advisory adds another item to the list. Okta's Access Gateway advisory, dated October 22, covers CVE-2026-115547, an admin-console command-execution flaw scored 9.1. Okta says versions before 2026.10.2 are affected and that the fix ships in 2026.10.2 [11]. GBHackers reports that Okta has no known active exploitation [12]. Teams that run Okta Access Gateway should track that patch separately from the Oracle work.

What IT teams should do before the next patch window

Start with inventory and work down the list:

  • Inventory every Oracle product and version in your environment first [2]. Cover Oracle Database, E-Business Suite, Fusion Middleware, Java SE, MySQL, PeopleSoft and Siebel CRM [6][7].
  • Patch the six CVSS 10.0 items and the E-Business Suite Workflow flaw CVE-2026-101809 first [5][6].
  • Apply all relevant patches in the advisory rather than cherry-picking individual fixes [7].
  • Bookmark Oracle's E-Business Suite CPU reference article, MOS KA923, and check it for updates [2].
  • Review web-facing Oracle components for unusual access if they were unpatched before the release, and investigate any access you cannot explain.
  • Set an alert for any CISA catalog listing tied to this CPU.

Three things will determine how this story develops: whether CVE-2026-101809 appears in CISA's catalog, whether Oracle's advisory settles the critical and remote-exploit counts, and whether other emergency patches push Oracle work down the queue. Teams that close the CVSS 10.0 items this week will be in a strong position whatever those answers turn out to be.