Six 10.0s and 1,295 Patches: Oracle’s October CPU Opens With an Unauthenticated E-Business Suite Takeover
Oracle’s October 2026 Critical Patch Update is the largest of the year by the only metric that matters to defenders: unauthenticated network reach. The advisory, released 20 October 2026, contains 1,295 new security patches fixing 1,209 unique CVEs across 33 product families, and 562 entries in Oracle’s risk matrices describe bugs a remote attacker can exploit without any credentials. We read the advisory first-hand and confirmed the severity stack ourselves: six flaws carry the maximum CVSS 3.1 score of 10.0, every one of them remotely exploitable without authentication, and every one of them with a scope change — meaning a successful attack spreads beyond the vulnerable component. The headliner is CVE-2026-101809, an unauthenticated takeover of Oracle E-Business Suite over plain HTTP.
The mailer that owns the suite
CVE-2026-101809 sits in the Workflow Notification Mailer of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15 — effectively every supported EBS release. The NVD record (published 20 October, still awaiting analysis) carries the full vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network attack, low complexity, no privileges, no user interaction, changed scope, total loss of confidentiality, integrity and availability. Oracle’s own matrix marks it “easily exploitable” over HTTP. While the vulnerability is in Workflow, the record warns that attacks may significantly impact additional products. A notification mailer is easy to dismiss as plumbing; this one can hand over the suite.
The EBS numbers around it deserve attention too. The update ships 194 E-Business Suite patches, all of them landing on the same 12.2.3–12.2.15 range, and the same matrix rows include CVE-2026-101767 (9.8, Application Object Library Core) and CVE-2026-101634 (9.1, Mobile Field Service) — both unauthenticated over HTTP. Anyone running EBS is not applying one fix; they are applying a service pack’s worth of remotely reachable corrections in a single window.
The other five 10.0s
We verified each of the remaining maximum-severity rows in the advisory text. They cluster exactly where an attacker doing internet-wide reconnaissance would look:
- CVE-2026-87337 — Oracle Access Manager, Authentication Engine, HTTP, versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is in the front door of single sign-on itself.
- CVE-2026-91231 — Oracle SOA Suite Adapters over HTTP; CVE-2026-91216 and CVE-2026-91221 — SOA Suite Fabric Layer over T3 and IIOP. Three 10.0s in the integration tier that typically listens on enterprise backbones.
- CVE-2026-91299 — JD Edwards EnterpriseOne Orchestrator (E1 IoT Orchestrator Security), HTTP, versions 9.2.0.0–9.2.26.5. The manufacturing and logistics footprint’s API layer, unauthenticated.
Fusion Middleware leads the quarter in severity with 40 critical patches, and much of the critical volume elsewhere comes from bundled third-party libraries — OpenSSL, curl, Apache MINA, the Spring Framework — with Oracle Communications alone carrying 30 critical patches rooted in those dependencies. Java SE, notably, has no critical flaws this quarter, though 49 of its 55 patches remain remotely exploitable without authentication.
What to do, in order
- Patch internet-facing EBS, Access Manager, SOA Suite and JD Edwards first, this week. Six unauthenticated 10.0s with scope change is not a “next maintenance window” situation. Oracle’s matrices flag none of these as exploited in the wild and no public proof of concept is confirmed — but past cycles show attackers reverse-engineering Oracle patches within days, and last year’s exploitation of E-Business Suite flaw CVE-2025-61882 in a large data-theft and extortion campaign is the reason EBS sits at the top of the queue.
- Where patching must wait, shrink the reachable surface. Block T3 and IIOP traffic from untrusted networks and keep E-Business Suite and middleware consoles off the public internet. The SOA Fabric Layer 10.0s are only reachable if those protocols are.
- Inventory before the patch window, not during it. EBS 12.2.3–12.2.15 covers effectively the whole supported fleet, but the Access Manager, SOA and JD Edwards fixes are version-pinned — know which builds you run before change control meets.
- Treat the mailer as identity infrastructure. Workflow notifications touch approvals, purchase orders and HR actions across the suite. A changed-scope takeover of that component inherits the trust of everything downstream of it, which is the same reason the September PeopleSoft mass-exploitation wave hurt: Oracle’s business applications hold payroll, supply-chain and identity data behind web endpoints attackers already scan.
The structural lesson is the one Oracle’s own numbers keep teaching: the products that face the internet — WebLogic, SOA Suite, Access Manager, E-Business Suite — are also the products that keep producing unauthenticated maximum-severity flaws, quarter after quarter. 562 remotely exploitable entries without credentials is not six bad bugs; it is an exposure model. Patch the six 10.0s first, then ask why the consoles were reachable at all.
Our verification was read-only. The 1,295-patch count, the six CVSS 10.0 rows (CVE-2026-101809, CVE-2026-87337, CVE-2026-91231, CVE-2026-91216, CVE-2026-91221, CVE-2026-91299) with their products, components, protocols, versions and vectors were read first-hand from Oracle’s October 2026 advisory. The NVD vector, publication timestamp and “Awaiting Analysis” status for CVE-2026-101809 were read first-hand from the NVD record. The 20 October 2026 release date, the 1,209-unique-CVE and 33-family figures, the 562 unauthenticated entries, the per-product patch counts, the absence of in-the-wild flags and the CVE-2025-61882 precedent were reported via SecurityOnline.info and are attributed as such. No Oracle system was probed and no exploit was run. Brave Search was used for discovery only.
Sources: