Oracle Patches Over 1,200 security flaws With October 2026 CPU

What happened

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. Vulnerabilities Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU (the general-purpose processor at the centre of a computer) Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. Oracle is a software development and information technology consulting company based in Redwood Shores, and its products and services include software.

Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication. A significant number of patches were also rolled out for E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55), and Supply Chain (50).

Oracle has not flagged any of these vulnerabilities as exploited in the wild, but the software giant has reminded customers that it periodically receives reports of exploitation attempts targeting its products. On Wednesday, one day after announcing the CPU, Oracle published a separate advisory and security alert for CVE-2026-91403 (the public catalogue number for a specific software flaw) , which is Java’s (and Oracle’s) response to the eMudhra weak-key incident .

The latest updates bring 1,295 new fixes across dozens of products.

According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws. Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity.

These types of updates go out on the third Tuesday of every month. The next CPU is scheduled for January 19, 2027.