Oracle's October CPU: 1,295 patches and six 10.0 flaws that need no password

The volume is the first problem

Oracle released its October Critical Patch Update on 20 October with 1,295 new security patches, and six of them carry the maximum CVSS 3.1 score of 10.0. The headline number is the smaller fact. Fusion Middleware alone accounts for 206 patches, 134 of them remotely exploitable without authentication, and E-Business Suite adds 194 patches with 31 in the same category. A team that triages only the 10.0s leaves more than 150 unauthenticated flaws untouched.

All six maximum scores are network reachable with no credentials and no user interaction, and the scope is recorded as changed, so a compromise can reach beyond the vulnerable component. Oracle's risk matrices give no exploit detail beyond the score. The useful split is by protocol rather than by product: three of the six are reached over HTTP, two over T3 or IIOP, and the sixth over HTTP inside JD Edwards. The protocol decides which network control buys time while the window is booked.

The six 10.0s and the builds that carry them

Five of the six sit in products a finance estate already runs: E-Business Suite Workflow, three components of SOA Suite, and Access Manager. The sixth is JD Edwards EnterpriseOne Orchestrator, which matters to supply chain rather than finance. The version ranges are narrow enough to check tonight, and a build number is the only evidence that the fix is present.

A worked example: one finance estate, two windows

Take an estate on EBS 12.2.9, SOA Suite 12.2.1.4.0, Access Manager 12.2.1.4.0, WebLogic 14.1.2.0.0 and APEX 24.1.10. It carries five of the six 10.0 flaws and four of the 9.8s: CVE-2026-101809 and CVE-2026-101767 in EBS, CVE-2026-91216, CVE-2026-91221 and CVE-2026-91231 in SOA Suite, CVE-2026-87337 in Access Manager, CVE-2026-83399 and CVE-2026-91323 in WebLogic, and CVE-2026-101521 in APEX. JD Edwards is the one gap, and only if the estate runs it.

That is nine CVEs across five products, and it does not need five change windows. SOA Suite, Access Manager and WebLogic share middleware tooling and a rollback path, so they belong in one window. EBS and APEX both touch the application tier and both need a business owner, so they belong in a second. The estate pays two windows and one regression cycle, and the middleware work carries no finance sign-off.

Where the 10.0 hides behind a port

Two of the SOA Suite flaws, CVE-2026-91216 and CVE-2026-91221, are reached over T3 or IIOP rather than HTTP. Those are the channels WebLogic-based middleware uses between tiers, and they are often open inside a data centre because closing them breaks something. Oracle describes both as easily exploitable. The same protocol carries WebLogic's CVE-2026-83399 at 9.8, which is why a port scan belongs in the same week as the patch booking.

Access Manager is the identity tier, so the blast radius is larger than the component. CVE-2026-87337 lets an unauthenticated attacker with network access over HTTP create, delete or modify critical data, and Oracle scores impact on confidentiality and integrity but not availability. The advisory does not describe a workaround. Until the patch lands, the control is network placement: which addresses can reach the Access Manager console and the middleware ports. For most estates that is a firewall change with a shorter lead time than a change board.

The three objections a change board raises

Oracle does not report exploitation for any of these CVEs, and nothing in the advisory supports the claim that it does. That is an argument about likelihood, not about exposure: the flaws are scored network reachable, low complexity, no privileges and no user interaction. Oracle's own boilerplate notes that attackers have succeeded against customers who had failed to apply available patches. A board can argue the probability; it cannot argue that an unauthenticated HTTP path costs nothing to close.

The second objection is that the EBS change board is full. The answer is to split the work rather than defer it. SOA Suite and Access Manager do not need a finance sign-off, and the T3 and IIOP fixes can run in a middleware outage while the EBS window waits for a quiet period.

The third is an old release. Oracle only patches versions under Premier or Extended Support, and its advisory says earlier versions are likely affected too. An estate outside that range has no patch to apply; the decision is an upgrade plus network restriction, not a maintenance window. That is a harder conversation, and it is better had before the board meets than after.

The decision rule for this window

Choose one combined window if EBS, SOA Suite and Access Manager share a change board and the middleware ports are reachable from outside their tier. The regression suites overlap enough that a single outage is cheaper than two, and the exposure justifies the shorter notice.

Choose two windows if finance cannot absorb an EBS outage on the same weekend. Patch the middleware first because it needs no business owner, then take EBS and APEX when the business can. The one thing not to do is defer the whole CPU because one product's board is full; that converts a scheduling problem into an exposure that lasts another quarter.

Confirm the build, not the ticket. The published ranges run from Workflow 12.2.3 through 12.2.15 to Orchestrator 9.2.0.0 through 9.2.26.5, and a version check is the only evidence that a patch applied. The case to the business is a reachability case, and it is strong enough without an exploitation claim.