Vulnerabilities · 3h ago

Oracle's October update flags four login-free network flaws

INCIBE-CERT says Oracle's October 20, 2026 Critical Patch Update includes 1,295 security fixes across 33 product families, including four critical flaws reachable over a network without authentication.

The four flaws affect Oracle E-Business Suite's Workflow Notification Mailer, Oracle Access Manager, and Oracle Service-Oriented Architecture (SOA) Suite; remote HTTP requests can reach some affected services, while SOA Suite has network-accessible interfaces. A separate high-severity OpenSSL flaw in Oracle Database Server is reachable remotely over Transport Layer Security (TLS). An attacker who can reach an affected service may compromise it without a stolen account.

For Oracle environments, exposure depends on the versions deployed and whether those specific components are network-reachable—not simply on whether the organization uses Oracle. The supplied reporting does not establish what an attacker could access after compromising a component.

CVE-2026-75803

NVD KEV

EPSS 0.2% (13th percentile).

CVE-2026-101809

NVD KEV

CVSS 10 CRITICAL: vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).

CVE-2026-87337

NVD KEV

CVSS 10 CRITICAL: vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

CVE-2026-91216

NVD KEV

CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).

CVE-2026-91221

NVD KEV

CVSS 10 CRITICAL: vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).

Timeline

Sources

3 sources covering this story

Entities

Part of the PlainSec briefing for 2026-10-21

Editions

Related stories