Oracle’s October update fixes 1,295 flaws. Start with E-Business Suite and WebLogic servers that face the internet

Oracle’s quarterly Critical Patch Update came out on Tuesday with 1,295 new security patches across databases, middleware, business applications, MySQL and Java.

Most of that is routine. The part to move on this week is a group of bugs that Oracle says can be exploited over the network with no login, in E-Business Suite and WebLogic Server, two products that companies often expose to the internet.

Of Oracle’s 1,295 patches, the ones to book this week are the no-login bugs in E-Business Suite and WebLogic.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Oracle’s October patch release covers 1,295 vulnerabilities

Oracle released the October 2026 Critical Patch Update on October 20. E-Business Suite gets 194 new patches, 31 of them for bugs that are remotely exploitable without authentication. Fusion Middleware, which includes WebLogic, gets 206, of which 134 need no login.

The top-rated E-Business Suite bug is CVE-2026-101809 in the Workflow Notification Mailer, scored 10.0, affecting versions 12.2.3 to 12.2.15. CVE-2026-101767 in Oracle Application Object Library scores 9.8 on the same versions. In WebLogic Server, CVE-2026-91323 (over HTTP) and CVE-2026-83399 (over T3 and IIOP) both score 9.8 and affect 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

Oracle does not list any of these as exploited. Its advisory repeats that it keeps receiving reports of attacks on flaws it has already patched, where customers had not applied the fixes.

E-Business Suite and WebLogic carry the no-login bugs

An E-Business Suite system holds payroll, purchasing and supplier data, and many companies publish parts of it for suppliers or remote staff. Oracle describes CVE-2026-101809 as easily exploitable by an unauthenticated attacker with network access over HTTP.

WebLogic sits under many Oracle and custom Java applications. CVE-2026-83399 uses the T3 and IIOP protocols, which have no reason to be reachable from the internet. Oracle also rates CVE-2026-91231 and CVE-2026-91216 in SOA Suite and CVE-2026-87337 in Oracle Access Manager at 10.0.

Patch internet-facing E-Business Suite and WebLogic first

• List every E-Business Suite 12.2.x instance and WebLogic domain, and mark which ones the internet can reach.
• Apply the October patches to those internet-facing systems first, then to internal ones. Oracle’s advisory links the patch availability document for each product.
• Block T3 and IIOP at the perimeter if they are open. WebLogic connection filters can restrict them to known hosts.
• Put Oracle Database (14 patches, including CVE-2026-75803, scored 9.8), MySQL (98 patches) and Java SE (55 patches) into your normal monthly cycle.

Details

• CVE-2026-101809: E-Business Suite Workflow Notification Mailer, CVSS 3.1 10.0, no authentication, HTTP. Versions 12.2.3 to 12.2.15.
• CVE-2026-101767: E-Business Suite Application Object Library, 9.8, no authentication, HTTP.
• CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3, IIOP): WebLogic Server Core, 9.8 each, no authentication.
• Totals: 1,295 new patches; E-Business Suite 194 (31 no-login); Fusion Middleware 206 (134 no-login); MySQL 98 (29 no-login); Java SE 55 (49 no-login).

Hunt / verify

• Scan your external ranges for WebLogic consoles and T3 listeners, commonly on port 7001, and for E-Business Suite login pages.
• Review web logs on internet-facing E-Business Suite servers for unusual requests to Workflow and notification URLs after October 20.
• Confirm the patch level afterwards with OPatch inventory on each WebLogic and database home.

Source: Oracle Critical Patch Update, October 2026; CVE.org: CVE-2026-101809

Sources

• Oracle: Critical Patch Update Advisory, October 2026
• CVE.org: CVE-2026-101809
• CVE.org: CVE-2026-91323

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].