Oracle October 2026: 34 Critical CVEs, SOA Suite on Top, Plus an Out-of-Band Java Alert

Oracle's October 2026 Critical Patch Update reached NVD on October 20, and it is a heavy one: 33 CVEs rated CRITICAL, from 9.1 to 10.0, across fourteen products. A day later Oracle added an out-of-band Security Alert for Java SE and GraalVM (CVE-2026-91403, 9.1), bringing the total to 34.

Two patterns stand out. First, Oracle SOA Suite alone accounts for ten critical CVEs, three of them 10.0 and unauthenticated. Second, six CVEs hit 10.0 and none of the six needs an account: SOA Suite, E-Business Suite, JD Edwards and Access Manager. Those are integration and authentication layers, which makes them gateways to everything else.

Every score below comes from Oracle (CNA secalert_us@oracle.com). NVD has analyzed none of these CVEs yet: most are Awaiting Analysis, the Essbase ones are Undergoing Analysis, the Java one is Received, and none has a CPE configuration.

The six 10.0 CVEs

Five of them share the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: unauthenticated attacker, easy exploitation, scope change, and an outcome Oracle sums up in one word, takeover. The sixth, CVE-2026-87337 in Access Manager, carries no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and still reaches 10.0.

Why these six come first:

• Access Manager is the SSO layer of an Oracle stack. A critical flaw in its Authentication Engine, with read and write access to critical data, reaches the access control of every application behind it. The scope change Oracle scored says exactly that.
• SOA Suite is the integration layer: it talks to the ERP, the CRM, the databases. Two of its three 10.0 CVEs go through T3 and IIOP, the WebLogic protocols, so a WAF in front of the HTTP port protects nothing.
• E-Business Suite's Workflow Notification Mailer processes inbound messages and is often reachable from more places than people assume.
• JD Edwards Orchestrator wires IoT feeds and integrations into the ERP and is frequently exposed to third-party systems.

The rest of the batch

9.9: takeover with an ordinary account (15 CVEs)

All require a low-privileged account (PR:L). In Oracle terms that is any regular application user; in an organization with hundreds of Essbase or Siebel users, it is not a barrier. The two Trusted Answer Search CVEs go through Oracle Net, the database protocol, and the Enterprise Manager ones target Data Guard management, i.e. database replication.

9.6: read and modify data (4 CVEs)

Low-privileged account, scope change, high confidentiality and integrity impact, no availability impact.

9.3: three unauthenticated CVEs

The first two need neither an account nor interaction. The Agile PLM for Process one requires action from another user (UI:R).

9.1: six CVEs, Java included

The Java alert: CVE-2026-91403

Oracle issues an out-of-band alert only when it decides a flaw cannot wait for the next quarterly patch. The component here is JSSE, Java's TLS implementation. The description says the flaw can be exploited through the component's APIs, for instance via a web service that feeds data to them, and that it also affects sandboxed Java Web Start applications or applets running untrusted code.

What makes this one awkward: Java is not something you inventory as a product, it is a dependency bundled into dozens of applications, servers and appliances. You almost certainly run more JDKs than the ones you installed yourself.

Affected versions

Oracle lists the affected supported versions; older unsupported releases are not assessed and should be treated as exposed.

⚠️ These are affected versions, not fixed ones. NVD publishes no fixed version: get the patch from My Oracle Support for your exact version, starting from the cpuoct2026 bulletin and, for Java, the alert-cve-2026-91403 alert.

To see what you run:

# Fusion Middleware (SOA, BPM, OHS, OAM): patch inventory of the ORACLE_HOME
$ORACLE_HOME/OPatch/opatch lsinventory

# Java: version of every JVM on a host
find / -name java -type f -perm -u+x 2>/dev/null | while read j; do echo "$j"; "$j" -version 2>&1 | head -1; done

Detection

• WebLogic ports: for the SOA Suite and Essbase CVEs reachable over T3 and IIOP, check from a standard user workstation which ports of the WebLogic domain answer. A T3 port reachable from the office network is a problem on its own.
• WebLogic logs: T3/IIOP connections from sources with no reason to invoke remote objects, unusual deserialization or protocol errors.
• Access Manager: sessions created without a matching authentication, error spikes in the OAM server logs.
• E-Business Suite: abnormal inbound messages processed by the Workflow Notification Mailer.
• Java: inventory the JVMs bundled into third-party applications and appliances, not just the JDKs your system team installed.

Mitigation

1. Start with the six 10.0 CVEs: SOA Suite, Access Manager, E-Business Suite Workflow, JD Edwards Orchestrator. No account needed, takeover and scope change: that calls for an emergency window, not the usual quarterly cycle.
2. Filter T3 and IIOP at the network level on every WebLogic domain, even before patching: those protocols are for component-to-component traffic, not for users.
3. Close internet exposure of SOA, OAM, EBS and JDE consoles and services that should not have it.
4. Review application accounts on Essbase, Siebel, Trusted Answer Search and Enterprise Manager: fifteen 9.9 CVEs only need a low-privileged account.
5. Treat Java as its own project: update the JDKs and JREs you control, then ask your vendors when their products will ship a fixed JVM.

The August batch already showed the same concentration of critical flaws on a handful of Fusion Middleware products: see our analysis of Oracle's August 2026 patch.

Why continuous monitoring matters for your Oracle stack

An Oracle CPU is a table of several hundred lines, products nobody can place anymore, and versions you can only read with OPatch. Matching that table against what actually runs in your environment is manual work, which is exactly why Oracle CVEs stay open for months. The out-of-band Java alert adds another layer: the bundled JVM nobody inventoried.

With cveo.tech, register your Oracle components, Fusion Middleware, E-Business Suite, Java, with their exact versions, and get an alert as soon as a critical CVE affects them.