[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0_kRMjCBoXny3IvnsGwlv0VyEJmZmLocelx4GrUe_XQ":3},{"article":4,"iocs":39,"watch_terms":44,"solutions":45,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f1201052-ae1a-4700-a101-009452cc6243","Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU","oracle-patches-over-1-200-vulnerabilities-with-october-2026-cpu-16cc29","Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek.","Oracle's October 2026 Critical Patch Update (CPU) addresses 1,295 new vulnerabilities across numerous products, with 95 of these rated as critical severity. Oracle Fusion Middleware received the largest number of fixes, including 134 remote exploitable flaws without authentication. While Oracle has not confirmed any of these vulnerabilities are being actively exploited in the wild, they remind customers of potential exploitation attempts.","Oracle released October 2026 CPU with 1,295 fixes, including 95 critical flaws.","https:\u002F\u002Fwww.securityweek.com\u002Foracle-patches-over-1200-vulnerabilities-with-october-2026-cpu\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FOracle.jpeg","2026-10-22T07:38:14+00:00","2026-10-22T12:00:04.277741+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Oracle","vendor",{"name":21,"type":22},"Fusion Middleware","product",{"name":24,"type":22},"E-Business Suite",{"name":26,"type":22},"Siebel CRM",{"name":28,"type":22},"Java SE",{"name":30,"type":22},"MySQL","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},[40],{"type":41,"value":42,"context":43},"cve","CVE-2026-91403","Java's response to the eMudhra weak-key incident",[18,21,24],{"controls":46,"vendors":133},[47,76,104],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":77,"product_name":101,"url":102,"description":103},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":105,"name":106,"problem":107,"products":108},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[134],{"slug":135,"name":18,"logo_path":136,"roles":137},"oracle","\u002Fvendor-logos\u002Foracle.png",[138],"affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"oracles-massive-1295-flaw-cpu-underscores-patch-management-urgency","Oracle's Massive 1,295-Flaw CPU Underscores Patch Management Urgency","Oracle's October 2026 Critical Patch Update exposes the sheer scale of vulnerability debt that can accumulate across enterprise software ecosystems, with 1,295 new flaws including 95 critical-severity issues. Most alarming is that Oracle Fusion Middleware alone carries 134 remotely exploitable vulnerabilities requiring no authentication — meaning attackers need only network access to potentially compromise systems. Organizations running unpatched Oracle products represent high-value, low-effort targets, as threat actors routinely reverse-engineer CPU patches to develop exploits within days of release. This incident reinforces that delayed patching of widely deployed enterprise middleware is one of the highest-risk postures an organization can maintain.",[144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":152,"PCI DSS Requirement 6":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; the scale of this CPU means covered entities must have processes capable of triaging and remediating hundreds of flaws rapidly to remain compliant.","PCI DSS Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching, making it directly relevant for any Oracle product environments that process, store, or transmit cardholder data.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline; the 134 unauthenticated remote-exploitable Fusion Middleware flaws demand exactly the kind of structured flaw remediation process this control mandates.","Running unpatched Oracle Fusion Middleware with known critical vulnerabilities is a textbook instance of this OWASP risk category, where failure to update components with disclosed flaws creates direct, exploitable attack surface.","With 1,295 vulnerabilities released in a single CPU, only a mature, automated vulnerability scanning and remediation cadence would ensure organizations identify and close all affected Oracle instances before attackers reverse-engineer the patches.","This control requires timely identification and remediation of technical vulnerabilities in software in use — directly applicable to organizations that must process and act on Oracle's massive quarterly patch release across their product estate.","The 134 unauthenticated remote-exploit flaws highlight that protective controls around authentication and access — such as network segmentation and authentication gateways in front of middleware — serve as critical compensating controls when patches cannot be applied instantly."]