Patching

Oracle's October CPU: 1,209 CVEs and an EBS SQL injection

By Yaali. October 21, 2026, 6 min read, Patching, Vulnerabilities.

Oracle's October 2026 Critical Patch Update fixes 1,209 CVEs, six at CVSS 10.0. How to triage it in a week, starting with an unauthenticated E-Business Suite flaw.

Oracle released its October 2026 Critical Patch Update (CPU) on October 20. Tenable counts 1,295 security patches fixing 1,209 unique CVEs across 33 product families, with 112 patches covering 95 critical CVEs. Six flaws score the maximum CVSS 10.0: four in Fusion Middleware, one in E-Business Suite (EBS) and one in JD Edwards. Oracle's pre-release notice from the week before described 1,283 patches, so the final total came in 12 higher, and some per-family counts moved between the two.

If you run EBS 12.2.3 to 12.2.15, Oracle SOA Suite, Access Manager or WebLogic Server, this release has flaws an attacker can use with no account and no user interaction. None was reported as exploited by October 21. EBS flaws have not stayed unexploited for long this year: CVE-2026-46817, an EBS Payments flaw Oracle fixed in May, was being exploited by the end of June.

Where the risk sits

Two families carry about a third of the release. Fusion Middleware has 206 patches, 134 of them reachable over the network without credentials. E-Business Suite has 194, with 31 unauthenticated. The other families most mid-size organisations run are smaller: MySQL has 98 patches (29 unauthenticated, top score 9.8), Java SE 55 (49 unauthenticated), and Oracle Database Server 14 (4 unauthenticated, top score 8.8). Oracle's pre-release notice put Database at 13 and EBS at 196, so expect small differences between trackers.

The six CVSS 10.0 flaws are:

All six need no login and carry a scope change, meaning a successful attack reaches beyond the vulnerable component. WebLogic Server gets 11 patches, every one remotely exploitable without authentication. Two are CVSS 9.8 and lead to full takeover: CVE-2026-83399 over T3 and IIOP, and CVE-2026-91323 over HTTP, both in the Core component of versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Essbase has 38 patches with a top score of 9.9.

How the EBS SQL injection works

Horizon3.ai found CVE-2026-101767 (CVSS 9.8) and reported it to Oracle on July 24. It sits in the Core component of Oracle Application Object Library, the shared foundation every EBS module runs on, in versions 12.2.3 to 12.2.15.

The vulnerable piece is the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. TCF lets thick Java client components, such as the Gantt charts used in project and manufacturing screens, exchange data with the server. The servlet accepts requests without checking that the caller is logged in (CWE-306, missing authentication), and input in those requests ends up in SQL that the database runs (CWE-89, SQL injection). Horizon3 says the default EBS URL firewall configuration allows the endpoint, so a standard internet-facing deployment exposes it.

The SQL runs as APPS, the schema that owns the EBS application objects. APPS can read and change financial, payroll, HR and procurement data. Horizon3 chained that into operating system commands as the EBS application account; its indicators point to the Concurrent Manager, the EBS job scheduler, starting a shell. Horizon3 has not published the injectable parameter or a proof of concept.

What attackers are doing

No exploitation of any flaw in this release had been reported by October 21. CISA's Known Exploited Vulnerabilities catalog does not list CVE-2026-101767, and the CVSS 10.0 flaws have no public exploit code.

EBS has a short history of quick exploitation. CVE-2025-61882 was used by Cl0p in a mass data theft and extortion campaign in 2025. CVE-2026-46817, fixed in May 2026, was confirmed exploited by June 30. Plan on the same for CVE-2026-101767 now that its endpoint name is public.

What to do this week

1. Day one: internet-facing EBS. Apply the October 2026 CPU patches for your release through the usual adop online patching cycle, using Oracle's EBS patch availability document (Horizon3 points to My Oracle Support note KA923). Check that AD and TXK are at the levels the CPU requires before you start, since that is where EBS patch windows usually slip.
2. Same day if you cannot patch. Remove /OA_HTML/AppsTCFServer from the URL firewall allowlist (url_fw.conf) on external web tiers, then restart Oracle HTTP Server. Better still, take the EBS web tier off the internet and put it behind a VPN or a reverse proxy that only accepts traffic from known ranges. Horizon3 notes both reduce exposure without replacing the patch.
3. Days two and three: Fusion Middleware. Patch SOA Suite, Access Manager and WebLogic. Block T3 and IIOP at the network edge with a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) so only admin hosts can reach them, which covers CVE-2026-91216, CVE-2026-91221 and CVE-2026-83399.
4. Days four and five: JD Edwards Orchestrator, MySQL, Essbase and Java SE. MySQL Server 8.0.0 to 8.0.48, 8.4.0 to 8.4.11 and 9.7.0 to 9.7.2 are affected. For Java, start with servers that run code from outside, and leave desktops on the normal cycle.
5. Normal cycle. Database Server, with a top score of 8.8, and the rest of the release.

Checking for compromise

Horizon3 lists four signs of CVE-2026-101767 use:

• Unauthenticated POST requests to /OA_HTML/AppsTCFServer in the Oracle HTTP Server access log that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by database activity.
• SQL reconnaissance just after those requests: queries for the database version, the current user and directory objects. Database auditing on the APPS schema or V$SQL history shows these.
• Unexpected files in $APPLPTMP, the temporary directory EBS uses for file I/O between the database and application tier.
• The oracle OS account starting /bin/sh through the Concurrent Manager.

Search back to at least July 24, when the flaw was first reported. If anything matches, treat the APPS password, the database host and the application tier as compromised: rotate APPS, SYSADMIN and the WebLogic admin passwords, review new EBS users and responsibilities, and look for changed concurrent programs.

A quarterly update needs a short list

A 1,209-CVE release is too large to test top to bottom in a week. The work is to know which Oracle products face the internet, which listen on T3 and IIOP, and which hold financial data, then patch those first and leave the rest to the normal window. That sort is only quick if the asset list already records EBS URLs, WebLogic listen ports and which hosts are reachable from outside.

Our attack surface management work finds the Oracle endpoints you expose, and on-demand risk reduction can help get a CPU through in a week. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: Oracle October 2026 CPU advisory, Oracle Security blog, Security Boulevard (Tenable), SecurityOnline, SecurityOnline on Fusion Middleware, Horizon3.ai on CVE-2026-101767, Mallory, about InfoSec pre-release summary, Strix on CVE-2026-101767, Strix on CVE-2026-101809, Strix on CVE-2026-87337, Strix on CVE-2026-91231, Strix on CVE-2026-91216, Strix on CVE-2026-91221, Strix on CVE-2026-91299, Strix on CVE-2026-83399, Strix on CVE-2026-91323, Google Threat Intelligence on CVE-2025-61882, Smarttech247 on CVE-2026-46817, SOCRadar on CVE-2026-46817.