Oracle released its October 2026 Critical Patch Update (CPU), addressing 1,295 vulnerabilities across various products.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-91403 | 9.1 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches (2026-10-21)
Business impact
Organizations using Oracle products face potential security risks, as these vulnerabilities could be exploited, leading to operational disruptions and data breaches.
Industries affected
Industries affected include enterprise software, financial services, retail, hospitality, and healthcare.
Users affected
Customers using Oracle's E-Business Suite, Siebel CRM, Fusion Middleware, and other products need to update to mitigate risks.
