Oracle October patch update fixes 1,295 flaws including six CVSS 10.0 bugs

Oracle ships 1,295 fixes in its October patch update

Oracle published its October 2026 Critical Patch Update on the night of 20 October, with the CVE records synchronised to NVD and national vulnerability databases the following day, according to a dev.to analysis of the release. The quarterly bundle addresses 1,295 vulnerabilities across Oracle's product families. Six carry the maximum CVSS v3.1 base score of 10.0, and per the write-up all six can be exploited remotely with no authentication required and all use scope-changed vectors, meaning a compromise of the affected component is expected to spill into resources beyond its own security authority.

The six maximum-severity flaws

The dev.to breakdown identifies the 10.0-rated entries as follows:

• CVE-2026-101809 affects the Workflow Notification Mailer in Oracle E-Business Suite, versions 12.2.3 through 12.2.15. An unauthenticated attacker with HTTP access can seize control of Workflow, and the write-up reports that Oracle warns successful attacks may spill over to additional products.
• CVE-2026-91216 and CVE-2026-91221 both target the Fabric Layer of Oracle SOA Suite, versions 12.2.1.4.0 and 14.1.2.0.0, and are reachable over the T3 and IIOP protocols.
• CVE-2026-91231 affects the SOA Suite Adapters component over HTTP.
• CVE-2026-87337 affects the authentication engine in Oracle Access Manager, versions 12.2.1.4.0 and 14.1.2.1.0, over HTTP.
• CVE-2026-91299 affects the JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0 through 9.2.26.5, over HTTP.

A tier below, four entries would headline a quieter month. CVE-2026-83399 and CVE-2026-91323 both score 9.8 in WebLogic Server Core, the first reachable over T3 and IIOP and the second over HTTP, and each lets an unauthenticated network attacker seize the server. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. CVE-2026-101767 rates 9.8 in the E-Business Suite Application Object Library, and CVE-2026-101521 rates 9.8 in Oracle APEX, spanning multiple 24.1.x, 24.2.x and 26.1.x releases.

Why T3 and IIOP reachability decides urgency

The dev.to post's central argument is that protocol exposure matters as much as patch timing. T3 and IIOP are the channels WebLogic uses for remote administration and EJB communication. They are not HTTP: they do not appear in web server logs in a form most teams can read, WAFs rarely inspect them, and firewall rules that broadly allow the internal application tier to reach WebLogic frequently leave them open.

Four of the update's most severe entries, both 10.0 SOA Suite flaws and both 9.8 WebLogic flaws, arrive over T3 or IIOP. An estate where those protocols are reachable only from the specific management hosts that need them is not exploitable through the network paths these CVEs describe, regardless of patch status. The reverse is harsher: where T3 or IIOP is exposed broadly, the absence of authentication is the only barrier, which turns the patch into an emergency rather than a quarterly item.

Scope change shapes containment

Because the 10.0s carry scope-changed vectors, containment means more than patching the broken component. A takeover of SOA Suite exposes everything SOA Suite can reach, and for Fusion Middleware that typically includes data source passwords, JMS destinations, keystores and domain administrative credentials, all of which should be treated as exposed in an incident response plan. The write-up also notes that Oracle's advisory repeats the company's standing statement that it continues to receive reports of malicious exploitation, some of it successful.

Why it matters

The cadence is routine; the content is not. Six pre-authentication, maximum-score flaws in widely deployed middleware justify immediate triage. The dev.to analysis recommends patching internet-facing and T3-exposed systems first, then restricting T3 and IIOP at the network layer everywhere else, a zero-cost control that closes the path for several of these CVEs at once. Three blind spots stand out: legacy WebLogic 12.2.1.3.0 domains, which appear in Oracle's affected-products table but are easy to miss when the fixed-version list starts at 12.2.1.4.0; forgotten SOA Suite domains left over from long-finished integration projects, which still count as 10.0-bearing systems; and APEX instances whose versions lag behind the databases they run on in many teams' tracking.