Massive Oracle Security Update – 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability

Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across its software portfolio. Published on October 20.

The update includes a maximum-severity Oracle E-Business Suite vulnerability that allows attackers without login credentials to take over an affected Workflow component through network access.

The headline figure reflects security patches rather than 1,295 separate flaws. Oracle notes that the same vulnerability can affect several products and appear in multiple risk matrices.

Tenable’s analysis counts 1,209 unique CVEs across 33 Oracle product families, highlighting the scale of this release. The most urgent E-Business Suite issue is CVE-2026-101809, which affects the Workflow Notification Mailer component in versions 12.2.3 through 12.2.15.

It carries a CVSS 3.1 score of 10.0, the highest possible rating. An attacker can exploit the weakness over HTTP without authentication, and Oracle describes it as easy to exploit.

A successful attack can lead to takeover of Workflow, putting its data and operation at risk. Oracle also warns that the impact could extend to other products.

The flaw therefore deserves attention beyond the affected mailer component, particularly where connected business systems depend on the same application environment.

Oracle Security Update

Another serious issue, CVE-2026-101767, affects the Core component of Oracle Application Object Library. Rated 9.8, it allows remote exploitation over HTTP without credentials or user interaction.

Supported versions 12.2.3 through 12.2.15 are affected, with high potential impact on data privacy, data integrity, and service availability.

The Oracle October 2026 advisory also lists CVE-2026-75803 in the Database Server’s OpenSSL component. This 9.8-rated vulnerability can allow an unauthenticated attacker using TLS network access to take over the affected component. Database versions 19.3 through 19.32 and 23.4.0 through 23.26.3 are affected.

Oracle APEX receives a critical fix for CVE-2026-101521, another 9.8-rated issue. It allows takeover through HTTPS without authentication and affects versions 24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4. Oracle provides further impact details in its technical risk descriptions.

Earlier incidents highlight the risks of delaying Oracle patches. Cybersecurity News previously reported active exploitation of CVE-2026-4681, affecting Oracle Payments.

A separate mass exploitation campaign targeting E-Business Suite was linked to CVE-2025-61882. Neither incident confirms exploitation of the newly disclosed Workflow flaw.

Oracle says it continues to receive reports of successful attacks against customers who have not installed available patches. The company urges organizations to remain on supported versions and apply security updates without delay.

Administrators should check installed versions against Oracle’s affected-product tables and follow the patch availability documents for installation instructions.

E-Business Suite customers must also review the underlying Database and Fusion Middleware components, whose fixes are listed separately.

emporary network restrictions may reduce exposure, but Oracle warns that they can disrupt applications and do not fix the underlying flaws. Test these changes before production use, and treat them only as short-term protection until patches are deployed.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Massive Oracle Security Update – 1295 Flaws Patched, Including Critical E-Business Suite Vulnerability appeared first on Cyber Security News.