WORLDTECHOracle Issues 1,295 Security Patches in October Critical Patch Update
Oracle has published a Critical Patch Update for October 2026 that carries 1,295 new security patches for its enterprise software, according to GBHackers. The advisory, dated October 20, covers Oracle's own products as well as third-party components, and it includes flaws that attackers can exploit remotely without logging in.
Scope of the October update
The affected products span databases, middleware, business applications, Java, MySQL and virtualisation platforms. Oracle Database products alone received 126 new patches, spread across components including the Database Server, APEX, Essbase, GoldenGate and REST Data Services. Two of the fixes also reach client-only installations, the report notes.
Severe flaws in Database Server and APEX
The most serious entry is CVE-2026-75803, a weakness in the OpenSSL component of the Database Server that has received a CVSS 3.1 score of 9.8. According to the report, it can be triggered over TLS without credentials or user action, and Oracle rates its possible impact on confidentiality, integrity and availability as high.
Oracle APEX received two patches. CVE-2026-101521 in the General component also scores 9.8 and can be reached over HTTPS by unauthenticated attackers, with low complexity and no user interaction; it affects APEX versions 24.1.0 to 24.1.21, 24.2.0 to 24.2.20 and 26.1.0 to 26.1.4. The second APEX issue, CVE-2026-66010, sits in the bundled DOMPurify component and scores 6.1, requiring user interaction. The report uses the contrast to argue that administrators should assess the prerequisites of each flaw rather than treat all patches alike.
Essbase fixes and ongoing attack attempts
Oracle Essbase received 38 patches addressing 14 vulnerabilities that can be exploited remotely without authentication. Four of them, CVE-2026-91637, CVE-2026-91638, CVE-2026-91658 and CVE-2026-91663, carry CVSS scores of 9.9 and affect version 21.8.3.0.0.
Oracle has warned that attackers keep trying to exploit flaws for which fixes already exist. The report says some successful intrusions happened because customers had not installed the necessary corrections, which underlines the case for prompt remediation and for staying on supported software versions.
Open questions
- Which customers were affected by the attacks that succeeded?
- Will Oracle provide more detail on the third-party components covered by the update?