Oracle October 2026 Critical Patch Update: 1,295 Security Fixes Covering 1,209 CVEs

On October 20, Oracle released its Critical Patch Update with 1,295 new security fixes. An independent breakdown by Tenable puts the number of unique CVE identifiers at 1,209. The release covers many product families, so your review should not stop at databases.

What was released

Oracle’s official advisory lists the affected products and versions and links to installation instructions. The fixes cover Oracle’s own code as well as third-party components bundled with its software. Affected product families include Fusion Middleware, E-Business Suite, PeopleSoft, Java SE and MySQL.

There are more fixes than unique CVEs because a single vulnerability may need to be fixed in several products. Don’t treat the two numbers as the same thing. The news on October 20 was the release of the update itself. Oracle’s earlier pre-release announcement did not replace the final advisory.

How to prioritize updates

Oracle recommends running supported versions and applying patches without delay. However, the release announcement alone does not confirm that every vulnerability it describes is being actively exploited.

For administrators, the key step is to check Oracle’s tables against the systems you actually run. When setting priorities, consider whether a service can be reached from the internet, whether an exploit requires authentication, what an attack could do, and how important the application is to the business. This is a recommended way to assess risk, not a single update deadline that fits every installation.

What to do now

• Build an inventory of Oracle products, their versions and the administrators responsible for them, including services run by partners.
• Compare that inventory against the final October advisory.
• Prioritize vulnerable services reachable from untrusted networks, and flaws that can be exploited without logging in.
• Prepare backups, application functionality tests and a rollback plan in case a change fails.
• After deployment, confirm the patch level of every instance instead of relying on the installer finishing.
• Document systems still awaiting patches, who owns the decision and when the risk will be reassessed.

SecurHUB’s take

An update this large depends on an accurate inventory and clearly assigned responsibilities. A security audit can help determine whether your vulnerability management process covers every critical component of your environment.

Sources: Oracle, Tenable