Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw

Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw

20 October 2026: Oracle's October 2026 Critical Patch Update contains 1,295 new security patches, and the one most E-Business Suite customers will want first is CVE-2026-101767: a flaw in Application Object Library, rated CVSS 9.8, that an attacker can exploit over HTTP without a login on every supported release from 12.2.3 to 12.2.15. Oracle's risk matrix lists 31 of the 194 new E-Business Suite patches as remotely exploitable without authentication.

Not yet independently verified. Oracle's page carries no release date; we date it to the third Tuesday of October, Oracle's published schedule. The servlet path and the SQL injection detail come from Horizon3.ai, which reported the flaw, not from Oracle. We will update this when it can be confirmed, and remove this note.

The E-Business Suite flaw in detail

Oracle's matrix gives the bare facts: component Core, protocol HTTP, no privileges or user interaction needed, high impact on confidentiality, integrity and availability. Horizon3.ai, which reported the flaw to Oracle on 24 July, describes it as an unauthenticated SQL injection reached through the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. It says the injected SQL runs as the APPS database user, which an attacker can turn into operating-system commands under the EBS application account, and that the endpoint is allowed by the default EBS URL firewall configuration.

Until the patch is applied, Horizon3 suggests taking /OA_HTML/AppsTCFServer off the URL firewall allowlist and keeping the EBS web tier reachable only from trusted networks. It lists unauthenticated POST requests to that servlet, followed by database reconnaissance queries, as the pattern to look for in logs. E-Business Suite holds finance, payroll, HR and procurement records, which is what makes an unauthenticated route to the APPS schema serious; our Oracle E-Business Suite listing sits among 11 products in the ERP category.

Where the rest of the 1,295 patches land

The largest product families in this update, by Oracle's own counts:

Product family	New patches	Exploitable without login
Oracle Fusion Middleware	206	not totalled on the page
Oracle E-Business Suite	194	31
Oracle Database products	126	not totalled on the page
Oracle Communications	110	not totalled on the page
Oracle MySQL	98	29
Oracle Java SE	55	49

Other entries rated 9.8 include CVE-2026-91323 in WebLogic Server's Core component, four in the SOA Suite Fabric Layer, and flaws in WebCenter Content, WebCenter Sites, Business Process Management Suite and Data Integrator. The Java SE patches cover 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27, so desktop and server Java runtimes outside the Oracle stack need the update too.

The patch calendar from here

Oracle repeats its standing advice to "remain on actively-supported versions and apply security patches without delay". Its page lists the next dates: smaller Critical Security Patch Updates on 17 November and 15 December 2026, and the next full Critical Patch Update on 19 January 2027. EBS patch details are in My Oracle Support note KA923.

Related on TrustList:

• PeopleSoft attacks are back and slip past WAF rules: Oracle’s June patch for CVE-2026-35273 is the only fix
• Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up
• Google Data Studio will stop connecting to MySQL 5.6 and 5.7 after 26 February 2027

Sources

• Oracle Critical Patch Update Advisory, October 2026 (read 21 October), 21 October 2026
• Horizon3.ai: CVE-2026-101767, Oracle E-Business Suite, 20 October 2026