Oracle published its Critical Patch Update Pre-Release Announcement for October 2026 on 15 October (US time), giving advance notice that the quarterly CPU will be released on Tuesday 20 October 2026 (early Wednesday 21 October in Australia) and will contain 1,283 new security patches across its product families.

Oracle notes the pre-release figures can change before the advisory is published. The biggest buckets are Oracle E-Business Suite and Oracle Fusion Middleware (196 patches each; 34 and 132 of them remotely exploitable without authentication respectively), Oracle Communications (124; 87 unauthenticated remote), Oracle Siebel CRM (123; 67), Oracle PeopleSoft (109), Oracle JD Edwards (102; 44), Oracle MySQL (98) and Oracle Java SE (55; 49).

The highest CVSS 3.1 base scores Oracle lists are 10.0 for E-Business Suite, Fusion Middleware and JD Edwards; 9.9 for Siebel CRM, Essbase, Enterprise Manager and Trusted Answer Search; and 9.8 for APEX, Autonomous Health Framework, Secure Backup, Communications, HealthCare Applications, MySQL, PeopleSoft and Oracle Systems. Oracle Database Server gets 13 patches with a top score of 8.8.

CVE identifiers and per-product affected versions are only published with the advisory itself. Oracle is on this desk's vendor watchlist.

UPDATE (20 Oct): Oracle released the October 2026 CPU (Rev 1) with 1,295 new security patches; CVE lists, per-product versions and the six CVSS 10.0 flaws are on this desk's release card (oracle-cpu-oct-2026-1295-patches-ebs-soa-access-manager-cvss10-20261020).