Vulnerabilities & Exploits
Oracle's October update flags four login-free network flaws INCIBE-CERT says Oracle's October 20, 2026 Critical Patch Update includes 1,295 security fixes across 33 product families, including four critical flaws reachable over a network without authentication.
The four flaws affect Oracle E-Business Suite's Workflow Notification Mailer, Oracle Access Manager, and Oracle Service-Oriented Architecture (SOA) Suite; remote HTTP requests can reach some affected services, while SOA Suite has network-accessible interfaces. A separate high-severity OpenSSL flaw in Oracle Database Server is reachable remotely over Transport Layer Security (TLS). An attacker who can reach an affected service may compromise it without a stolen account.
For Oracle environments, exposure depends on the versions deployed and whether those specific components are network-reachable—not simply on whether the organization uses Oracle. The supplied reporting does not establish what an attacker could access after compromising a component.
3 sources · 4h ago
CVE-2026-75803 NVD KEV
EPSS 0.2% (13th percentile).
CVE-2026-101809 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
CVE-2026-87337 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
CVE-2026-91216 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
CVE-2026-91221 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
Timeline Sources Oct 21 CSIRT Italia / ACN
Critical Patch Update di Oracle
Oracle ha rilasciato il Critical Patch Update di ottobre che mira a correggere numerose vulnerabilità su più prodotti, di cui 64 con gravità “critica” e 383 con gravità “alta”.
original Oct 21 INCIBE-CERT
Múltiples vulnerabilidades en productos de Oracle
Oracle ha publicado 1.295 nuevos parches de seguridad para distintas familias de productos.
original Oct 20 Tenable
Oracle October 2026 Critical Patch Update 1209 CVEs | Tenable®
Oracle addresses 1209 CVEs in its October 2026 Critical Patch Update with 1295 patches, including 112 critical updates.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: Oracle's October update flags four login-free network flaws
More from today Vulnerabilities & Exploits
Oracle's October update flags four login-free network flaws INCIBE-CERT says Oracle's October 20, 2026 Critical Patch Update includes 1,295 security fixes across 33 product families, including four critical flaws reachable over a network without authentication.
The four flaws affect Oracle E-Business Suite's Workflow Notification Mailer, Oracle Access Manager, and Oracle Service-Oriented Architecture (SOA) Suite; remote HTTP requests can reach some affected services, while SOA Suite has network-accessible interfaces. A separate high-severity OpenSSL flaw in Oracle Database Server is reachable remotely over Transport Layer Security (TLS). An attacker who can reach an affected service may compromise it without a stolen account.
For Oracle environments, exposure depends on the versions deployed and whether those specific components are network-reachable—not simply on whether the organization uses Oracle. The supplied reporting does not establish what an attacker could access after compromising a component.
3 sources · 4h ago
CVE-2026-75803 NVD KEV
EPSS 0.2% (13th percentile).
CVE-2026-101809 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
CVE-2026-87337 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
CVE-2026-91216 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
CVE-2026-91221 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
Timeline Sources Oct 21 CSIRT Italia / ACN
Critical Patch Update di Oracle
Oracle ha rilasciato il Critical Patch Update di ottobre che mira a correggere numerose vulnerabilità su più prodotti, di cui 64 con gravità “critica” e 383 con gravità “alta”.
original Oct 21 INCIBE-CERT
Múltiples vulnerabilidades en productos de Oracle
Oracle ha publicado 1.295 nuevos parches de seguridad para distintas familias de productos.
original Oct 20 Tenable
Oracle October 2026 Critical Patch Update 1209 CVEs | Tenable®
Oracle addresses 1209 CVEs in its October 2026 Critical Patch Update with 1295 patches, including 112 critical updates.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: Oracle's October update flags four login-free network flaws
More from today