Vulnerabilities · 4h ago

Oracle's October patches cover distinct remote compromise paths

INCIBE-CERT says Oracle’s October Critical Patch Update delivers 1,295 security patches across product families. Its report highlights five CVEs: four rated CVSS 10.0 in E-Business Suite Workflow Notification Mailer, SOA Suite, and Access Manager, plus a 9.8 flaw in Oracle Database Server’s OpenSSL component.

The four 10.0 flaws can be exploited remotely without an account: through HTTP for Workflow Notification Mailer and Access Manager, or T3 and IIOP for SOA Suite. The database flaw also allows unauthenticated remote exploitation, but through TLS. Each path targets a different component; a reachable affected service could be compromised.

For Oracle estates, exposure depends on which affected products and versions are deployed and reachable, not the aggregate patch count. The cited reports do not say these flaws are being exploited, and Oracle’s product-specific patch matrix defines which installations are covered.

Timeline

• Oct 21 Reported by NCSC-NL Advisories
• Oct 20 Reported by Tenable

Sources

4 sources covering this story

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle Analytics

  Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher.

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle Communications

  Oracle heeft 110 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle E-Business Suite

  Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15.

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle MySQL

  De kwetsbaarheden in Oracle MySQL betreffen diverse componenten, waaronder MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors en MySQL Router.

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle Enterprise Manager

  De kwetsbaarheden in Oracle Enterprise Manager kunnen leiden tot ongeautoriseerde toegang tot gevoelige gegevens, wijzigingen in data en...

• NCSC-NL Advisories Oct 21

  Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise

  Oracle heeft nieuwe kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise.

• CSIRT Italia / ACN Oct 21

  Critical Patch Update di Oracle

  Oracle ha rilasciato il Critical Patch Update di ottobre che mira a correggere numerose vulnerabilità su più prodotti, di cui 64 con gravità “critica” e 383 con gravità “alta”.

• INCIBE-CERT Oct 21

  Múltiples vulnerabilidades en productos de Oracle

  Oracle ha publicado 1.295 nuevos parches de seguridad para distintas familias de productos.

• Tenable Oct 20

  Oracle October 2026 Critical Patch Update 1209 CVEs | Tenable®

  Oracle addresses 1209 CVEs in its October 2026 Critical Patch Update with 1295 patches, including 112 critical updates.

Entities

• CVE-2026-101809
• CVE-2026-75803
• CVE-2026-87337
• CVE-2026-91216

Part of the PlainSec briefing for 2026-10-21

Editions

• Briefing for 2026-10-21

Related stories

• Rapid7 finds flaws exploited before patch cycles catch up
• Plex2Shell widens beyond Plex to Siemens and SiteGuard
• Qilin and INC carry Palo Alto VPN access into hypervisors