Oracle Critical Patch Update, October 2026: unauthenticated flaws in Workflow, Access Manager and SOA Suite lead 426 fixes

The release at a glance

Oracle has published its October 2026 Critical Patch Update Advisory. The release covers 426 CVEs: 38 critical, 200 high, 161 medium and 27 low. Oracle E-Business Suite accounts for 194 of those, Oracle Fusion Middleware 170, Oracle Java SE 52, Oracle Database Server 9 and Oracle PeopleSoft 1. None of the CVEs appears in CISA KEV.

What matters most

The first group to examine is the set of critical, network-reachable flaws that require no prior authentication. In Oracle E-Business Suite, CVE-2026-101809 in Workflow Notification Mailer affects 12.2.3 to 12.2.15. It is easy to exploit over HTTP, has a CVSS 3.1 score of 10.0, and successful attacks can take over Workflow (confidentiality, integrity and availability impacts). In Oracle Fusion Middleware, CVE-2026-87337 in Oracle Access Manager affects 12.2.1.4.0 and 14.1.2.1.0. It has a CVSS 3.1 score of 10.0; an unauthenticated attacker over HTTP can read and modify all Oracle Access Manager accessible data, with scope change. The SOA Suite Fabric Layer has two 10.0 entries, CVE-2026-91216 and CVE-2026-91221, both unauthenticated over T3 or IIOP and able to take over SOA Suite. CVE-2026-91231 in the SOA Suite Adapters is also 10.0 unauthenticated over HTTP. Just below those are CVE-2026-91222 in Oracle Business Process Management Suite (9.9, low privileges over SOAP) and CVE-2026-91354 in Oracle Outside In Technology (9.9, low privileges over HTTP). In Oracle WebCenter Sites, CVE-2026-101499 is 9.8, unauthenticated over HTTP, and can take over WebCenter Sites.

Patch in this order

No CISA KEV entry appears for this release, so the patching order below is driven by reachability and CVSS. Oracle has published fixes for affected supported versions.

1. Start with CVE-2026-101809 in Oracle E-Business Suite Workflow: unauthenticated HTTP, CVSS 10.0, takeover.
2. Patch CVE-2026-87337 in Oracle Access Manager: unauthenticated HTTP, CVSS 10.0, full data read and modification.
3. Patch the SOA Suite Fabric Layer and Adapter flaws: CVE-2026-91216, CVE-2026-91221 and CVE-2026-91231, all CVSS 10.0 and unauthenticated over T3, IIOP or HTTP.
4. Patch CVE-2026-101499 in Oracle WebCenter Sites: unauthenticated HTTP, CVSS 9.8.
5. Patch CVE-2026-91354 in Oracle Outside In Technology and CVE-2026-91222 in Oracle Business Process Management Suite: network-accessible with low privileges, CVSS 9.9.
6. Then work through the remaining critical and high-severity entries in Oracle Fusion Middleware and Oracle E-Business Suite before the Java SE and Database updates, using Oracle's October 2026 CPU.

Beyond the patch

Oracle's quarterly CPU becomes manageable if you first establish which of these services are reachable and which lack an authentication boundary. Virtual CISO Services (vCISO) can map that exposure, because flaws such as CVE-2026-101809 and CVE-2026-87337 matter only where Workflow Notification Mailer or Oracle Access Manager is reachable. Implementation & Assessment Services can then verify the highest-risk paths through penetration testing and hardening, particularly the authentication, injection and deserialisation patterns behind the Fusion Middleware scores.