--- title: Oracle patched 1295 security flaws in October, six rated... description: Oracle's October Critical Patch Update fixed 1295 security vulnerabilities, including six rated 10.0 on the CVSS 3.1 scale. One hit Oracle E-Business Suite's... canonical: https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Oracle patched 1295 security flaws in October, six rated 10.0 | daily.dev og:description: Oracle's October Critical Patch Update fixed 1295 security vulnerabilities, including six rated 10.0 on the CVSS 3.1 scale. One hit Oracle E-Business Suite's... og:url: https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr og:image: https://api.daily.dev/og/posts/acw43yFhR.png og:image:alt: Oracle patched 1295 security flaws in October, six rated 10.0 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Oracle patched 1295 security flaws in October, six rated 10.0 **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary Oracle's October Critical Patch Update fixed 1295 security vulnerabilities, including six rated 10.0 on the CVSS 3.1 scale. One hit Oracle E-Business Suite's Workflow component (CVE-2026-101809), letting unauthenticated attackers compromise it via HTTP, affecting versions 12.2.3 through 12.2.15. Three 10.0 bugs hit Oracle SOA Suite, including two in the Fabric Layer exploitable over T3 or IIOP protocols. Oracle Access Manager had a 10.0 flaw allowing unauthorized modification of critical data, and JD Edwards EnterpriseOne Orchestrator had a 10.0 flaw allowing unauthenticated takeover. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-101809 in Oracle E-Business Suite Workflow? CVE-2026-101809 is a critical flaw, rated 10.0 on CVSS 3.1, that lets any unauthenticated attacker with network access via HTTP compromise the workflow notification mailer in Oracle E-Business Suite's Workflow component, potentially taking over Workflow and affecting other connected products. It affects Workflow versions 12.2.3 through 12.2.15. _Teams running E-Business Suite can track critical CVE disclosures like this one on daily.dev._ ### Which Oracle SOA Suite versions are affected by the October 2026 critical patch vulnerabilities? Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected by two 10.0-rated flaws, CVE-2026-91216 and CVE-2026-91221, in the Fabric Layer component, exploitable by unauthenticated attackers over the T3 or IIOP protocols. A third 10.0 bug, CVE-2026-91231, affects the Adapters component and also allows unauthenticated takeover. _Admins patching middleware stacks follow critical SOA Suite advisories like this through daily.dev._ ### How many vulnerabilities did Oracle fix in its October Critical Patch Update? Oracle fixed 1295 security vulnerabilities in its October Critical Patch Update Advisory, with six of them receiving the maximum CVSS 3.1 score of 10.0. The 10.0-rated flaws spanned Oracle E-Business Suite, Oracle SOA Suite, Oracle Access Manager, and JD Edwards EnterpriseOne Orchestrator. _Security teams tracking the scale of monthly Oracle patch releases follow advisories like this on daily.dev._ ## Similar posts on daily.dev - [Oracle releases 337 security patches, including fix for critical Apache Tika flaw](https://daily.dev/posts/oracle-releases-337-security-patches-including-fix-for-critical-apache-tika-flaw-ylp4u4dhr) · CSO Online · 0 upvotes · 0 comments - [Oracle July 2026 Critical Patch Update 1235 CVEs](https://daily.dev/posts/oracle-july-2026-critical-patch-update-1235-cves-irkciptx1) · Tenable Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Oracle patched 1295 security flaws in October, six rated 10.0","url":"https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr"},"datePublished":"2026-10-23T18:02:17.714Z","dateModified":"2026-10-28T21:05:16.858Z","description":"Oracle's October Critical Patch Update fixed 1295 security vulnerabilities, including six rated 10.0 on the CVSS 3.1 scale. One hit Oracle E-Business Suite's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d71e6ab8cba993bf45d80de30c650a9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d71e6ab8cba993bf45d80de30c650a9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,oracle","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Oracle patched 1295 security flaws in October, six rated 10.0"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/oracle-patched-1295-security-flaws-in-october-six-rated-10-0-acw43yfhr#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-101809 in Oracle E-Business Suite Workflow?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-101809 is a critical flaw, rated 10.0 on CVSS 3.1, that lets any unauthenticated attacker with network access via HTTP compromise the workflow notification mailer in Oracle E-Business Suite's Workflow component, potentially taking over Workflow and affecting other connected products. It affects Workflow versions 12.2.3 through 12.2.15. Teams running E-Business Suite can track critical CVE disclosures like this one on daily.dev."}},{"@type":"Question","name":"Which Oracle SOA Suite versions are affected by the October 2026 critical patch vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected by two 10.0-rated flaws, CVE-2026-91216 and CVE-2026-91221, in the Fabric Layer component, exploitable by unauthenticated attackers over the T3 or IIOP protocols. A third 10.0 bug, CVE-2026-91231, affects the Adapters component and also allows unauthenticated takeover. Admins patching middleware stacks follow critical SOA Suite advisories like this through daily.dev."}},{"@type":"Question","name":"How many vulnerabilities did Oracle fix in its October Critical Patch Update?","acceptedAnswer":{"@type":"Answer","text":"Oracle fixed 1295 security vulnerabilities in its October Critical Patch Update Advisory, with six of them receiving the maximum CVSS 3.1 score of 10.0. The 10.0-rated flaws spanned Oracle E-Business Suite, Oracle SOA Suite, Oracle Access Manager, and JD Edwards EnterpriseOne Orchestrator. Security teams tracking the scale of monthly Oracle patch releases follow advisories like this on daily.dev."}}]} ```