Oracle’s October 2026 CPU contains 1,295 patches

Oracle’s October 20, 2026, Critical Patch Update (CPU) contains 1,295 new security patches across its product portfolio. The update covers vulnerabilities in Oracle code and third-party components included in Oracle products, and its product list extends well beyond databases, Java and MySQL to include Communications, JD Edwards, PeopleSoft, Solaris and VirtualBox.

Patch counts across selected product families

Oracle reports these counts for selected product families in the October CPU:

These are selected family totals, not a breakdown that adds up to all 1,295 patches. Oracle describes its Critical Patch Updates as usually cumulative, with each quarterly advisory covering additions since the previous CPU.

Oracle also says that 31 E-Business Suite patches, 134 Fusion Middleware patches, 49 Java SE patches, 77 Communications patches and 44 JD Edwards patches may be remotely exploitable without authentication. Those counts describe the potential exploitability of vulnerabilities addressed by the patches.

Check product versions and support coverage

Oracle provides CPU patches only for product versions covered by Premier Support or Extended Support. The affected versions and installation guidance are product-specific, so administrators need to match each installed product and version to its corresponding patch documentation in Oracle’s October CPU advisory.

CVE-2026-75803 affects specified Database Server versions

Oracle’s risk matrix scores CVE-2026-75803 at 9.8 on CVSS 3.1. The vulnerability is in the RDBMS OpenSSL component of Oracle Database Server. Oracle lists supported versions 19.3–19.32 and 23.4.0–23.26.3 as affected. The attack vector is network access via TLS; authentication and user interaction are not required. Oracle’s risk-matrix text gives the component, score and version ranges.

Oracle’s advice on patching and temporary controls

Oracle recommends applying CPU patches promptly. Before a patch is applied, blocking network protocols required for an attack or removing unnecessary privileges may reduce risk. Either change can disrupt application functionality, so Oracle advises testing it on non-production systems. The company describes these measures as temporary rather than long-term fixes.