Vulnerabilities & Exploits
Oracle's October patches cover distinct remote compromise paths INCIBE-CERT says Oracle’s October Critical Patch Update delivers 1,295 security patches across product families. Its report highlights five CVEs: four rated CVSS 10.0 in E-Business Suite Workflow Notification Mailer, SOA Suite, and Access Manager, plus a 9.8 flaw in Oracle Database Server’s OpenSSL component.
The four 10.0 flaws can be exploited remotely without an account: through HTTP for Workflow Notification Mailer and Access Manager, or T3 and IIOP for SOA Suite. The database flaw also allows unauthenticated remote exploitation, but through TLS. Each path targets a different component; a reachable affected service could be compromised.
For Oracle estates, exposure depends on which affected products and versions are deployed and reachable, not the aggregate patch count. The cited reports do not say these flaws are being exploited, and Oracle’s product-specific patch matrix defines which installations are covered.
4 sources · 5h ago
CVE-2026-75803 NVD KEV
EPSS 0.2% (13th percentile).
CVE-2026-101809 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
CVE-2026-87337 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
CVE-2026-91216 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
CVE-2026-91221 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
Timeline Sources Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle Analytics
Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher.
original Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle Communications
Oracle heeft 110 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.
original Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle E-Business Suite
Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: Oracle's October patches cover distinct remote compromise paths
More from today Vulnerabilities & Exploits
Oracle's October patches cover distinct remote compromise paths INCIBE-CERT says Oracle’s October Critical Patch Update delivers 1,295 security patches across product families. Its report highlights five CVEs: four rated CVSS 10.0 in E-Business Suite Workflow Notification Mailer, SOA Suite, and Access Manager, plus a 9.8 flaw in Oracle Database Server’s OpenSSL component.
The four 10.0 flaws can be exploited remotely without an account: through HTTP for Workflow Notification Mailer and Access Manager, or T3 and IIOP for SOA Suite. The database flaw also allows unauthenticated remote exploitation, but through TLS. Each path targets a different component; a reachable affected service could be compromised.
For Oracle estates, exposure depends on which affected products and versions are deployed and reachable, not the aggregate patch count. The cited reports do not say these flaws are being exploited, and Oracle’s product-specific patch matrix defines which installations are covered.
4 sources · 5h ago
CVE-2026-75803 NVD KEV
EPSS 0.2% (13th percentile).
CVE-2026-101809 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
CVE-2026-87337 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
CVE-2026-91216 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
CVE-2026-91221 NVD KEV
CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
Timeline Sources Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle Analytics
Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher.
original Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle Communications
Oracle heeft 110 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.
original Oct 21 NCSC-NL Advisories
Kwetsbaarheden verholpen in Oracle E-Business Suite
Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: Oracle's October patches cover distinct remote compromise paths
More from today