Oracle releases October 2026 Critical Patch Update with 1,209 CVEs

Oracle shipped its Critical Patch Update for October 2026 on October 20, 2026. The release covers 1,295 security updates that fix 1,209 unique CVEs across 33 product families.

This is the final quarterly Critical Patch Update of 2026. Oracle classified 112 patches as critical severity, a share of 8.6% across all patches. Those 112 critical patches cover 95 CVEs. Medium severity accounted for 47.3% of the patches, and high severity represented 36.7%.

Oracle Fusion Middleware led all product families with 206 patches, making up 15.9% of the total. Oracle E-Business Suite came next with 194 patches, or 15% of all updates.

Oracle Fusion Middleware leads all families in severity with 40 critical patches. Every one of the 194 Oracle E-Business Suite patches affects versions 12.2.3 through 12.2.15.

Six flaws earned the top CVSS rating of 10.0. Oracle’s risk matrices flag 562 entries that an attacker can exploit remotely without credentials. WebLogic and SOA Suite often face the internet, as do Access Manager and E-Business Suite. These products hold payroll, supply chain, and identity data.

Oracle Communications accounts for 30 critical patches, most of them tied to third-party libraries. Java SE has no critical flaws this quarter, though attackers can exploit 49 of its 55 patches remotely without authentication. Oracle described the flaws as “easily exploitable.”

Oracle’s risk matrices do not mark any of the October 2026 flaws as exploited in the wild. No confirmed public proof-of-concept code exists for this quarter’s flaws. History shows attackers often reverse-engineer Oracle patches within days.

Oracle tells customers to apply every relevant patch from the October 2026 advisory without delay. Oracle issues its Critical Patch Update four times a year, in January, April, July, and October.

Oracle’s September 2026 Critical Patch Update contained 673 patches fixing more than 800 vulnerabilities. Oracle’s August 2026 patch update addressed nearly 1,000 vulnerabilities.

Oracle fixed CVE-2026-21962 in its January 2026 Critical Patch Update. CVE-2026-21962 has a CVSS 10.0 base score and hits Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Systems that missed the January 2026 Critical Patch Update run versions 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0.

CISA put CVE-2026-21962 into its Known Exploited Vulnerabilities catalog on August 24, 2026, and directed federal agencies to remediate by August 27, 2026. A China-linked threat actor used CVE-2026-21962 for seven months against government and commercial networks in more than 100 countries.

CloudSEK logged more than 140,000 attempts to exploit CVE-2026-21962 from 21 countries across 12 days in January and February 2026. CloudSEK described the activity as “widespread automated scanning and exploitation attempts.”

Security researcher gregk4sec found the CVE-2026-21962 path-traversal vector on September 24, 2025. Someone published a working proof-of-concept exploit for CVE-2026-21962 on GitHub on January 22, 2026, two days after the patch was released.

HOSTGLOBAL.PLUS LTD produced 625 requests from four IP addresses in CloudSEK’s 12-day honeypot study. DigitalOcean was responsible for 461 requests from 28 addresses in the same study. In February 2026, one IP address tried to exploit CVE-2026-21962 together with flaws in Ivanti Endpoint Manager Mobile, GNU InetUtils, and GLPI.

CloudSEK’s 12-day honeypot also caught active exploitation attempts against CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271. CVE-2026-21962 is not the first Oracle WebLogic entry in CISA’s Known Exploited Vulnerabilities catalog. Oracle WebLogic has collected more than a dozen KEV entries over the years, most with CVE numbers from 2020 or earlier.

CISA’s Known Exploited Vulnerabilities catalog contains repeated entries for Oracle WebLogic and E-Business Suite flaws. In 2025, attackers exploited E-Business Suite flaw CVE-2025-61882 in a large data theft and extortion campaign.

SOCRadar recorded in July 2026 a China-linked state-aligned intrusion campaign that used CVE-2026-21962 as one of 11 exploit chains. The campaign targeted government, healthcare, and education sectors in more than 100 countries, with heavy activity in Taiwan.

BankInfoSecurity reporting tied the actor to groups UNC5174 and UNC6586, which researchers assess are contractors to China’s Ministry of State Security. The campaign relied on GoCobaltStrike, tunneling tooling, and four malware families including SNOWLIGHT. Mandiant first linked SNOWLIGHT to UNC5174.

BOD 26-04 took over from BOD 22-01’s flat severity-score deadlines with a four-variable risk model when issued on June 10, 2026. BOD 26-04’s four-variable model sets a three-calendar-day remediation deadline when an agency answers yes to all four risk questions. Agencies must install the patch and check whether systems were already compromised.

BOD 26-04 covers only Federal Civilian Executive Branch agencies, and private-sector organizations face no legal obligation. The 2026 Verizon Data Breach Investigations Report says 26% of KEV-listed vulnerabilities were fully remediated in 2025, compared with 38% the prior year.

Daily CyberSecurity says defenders should patch internet-facing WebLogic, SOA Suite, Access Manager, and E-Business Suite servers first. The outlet says to fix every flaw exploitable remotely without authentication next. It says to patch internal systems including Database Server, MySQL, and Java SE in the next maintenance window. When patching cannot happen yet, it says to block T3 and IIOP traffic from untrusted networks and keep E-Business Suite and middleware consoles off the public internet.