Oracle's October 2026 CPU Fixes 1,295 Flaws, Plus a Java Alert Tied to eMudhra

Past-week coverage · Original source published 2026-10-22.

Oracle published its October 2026 Critical Patch Update with 1,295 new fixes across dozens of products, according to SecurityWeek. An analysis by Tenable counted 1,209 unique CVEs in the release, including 95 rated critical, 439 high and 582 medium.

Fusion Middleware drew the largest share, with 206 fixes, 134 of which can be exploited remotely without authentication, per the report. Other heavily patched products included E-Business Suite (194), Siebel CRM (122), Communications (110), PeopleSoft (109), JD Edwards (102), MySQL (98), Java SE (55) and Supply Chain (50).

Oracle did not flag any of the CPU vulnerabilities as exploited in the wild, SecurityWeek reported, though the company said it periodically receives reports of exploitation attempts against its products.

A day after the CPU, Oracle issued a separate advisory and security alert for CVE-2026-91403, described as Java's and Oracle's response to the eMudhra weak-key incident. Oracle's advisory rates the JSSE flaw 9.1 under CVSS 3.1 and lists Java SE, GraalVM for JDK and GraalVM Enterprise Edition versions as affected. The source does not state a fix status.

Oracle scheduled Critical Security Patch Updates for November 17 and December 15, with the next CPU set for January 19, 2027.

What defenders should do: inventory Java and Fusion Middleware deployments against the advisory, and treat the separate Java alert as its own item rather than assuming the CPU covers it.

CVE references

CVE-2026-91403