Oracle October 2026 CPU Fixes 1,295 Flaws: What Java and MySQL Users Should Patch First

The Oracle October 2026 CPU is one of the biggest security updates the company has shipped, with 1,295 new patches across dozens of products. If you run Java, MySQL, E-Business Suite or Fusion Middleware, you should plan to patch soon. Oracle has not flagged any of these flaws as exploited yet.

Here is what the update covers, which products matter most, and how to roll it out without breaking things.

The key facts at a glance:

• Oracle released the Critical Patch Update (CPU) on October 20, 2026.
• It contains 1,295 new security patches, per Oracle’s advisory.
• Fusion Middleware has the most fixes (206), followed by E-Business Suite (194).
• Java SE and MySQL are both affected.
• Next CPU: January 19, 2027.

What’s inside the Oracle October 2026 CPU

According to SecurityWeek, the update fixes 1,209 unique CVEs, based on Tenable’s analysis. Of those, 95 are rated critical and 439 are high severity. Oracle counts patches and CVEs differently, so you will see both numbers quoted.

The biggest product families by patch count look like this:

The size alone isn’t the story. What matters is how many flaws can be reached over a network without a login. SecurityWeek says 134 of the Fusion Middleware fixes fall into that category.

Oracle also says the CPU came with a separate alert for CVE-2026-91403, tied to Java and the eMudhra weak-key incident, according to SecurityWeek. That one is worth a read if you manage certificates or code signing in Java apps.

In short, this quarter’s release is large mainly because Oracle bundles so many products into one date. That makes triage the real job, not reading every line.

Which products to patch first

Start with anything that faces the internet. Fusion Middleware and E-Business Suite often sit behind public portals, so a remotely exploitable bug there is the worst case. Oracle’s own page also lists unauthenticated network flaws in Database Server, APEX, Essbase and GoldenGate.

Next, check developer and server machines. Oracle lists Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1 and 25.0.4.1 among the affected versions. MySQL Server 8.4.0 through 8.4.12 and 9.7.0 through 9.7.3 are on the list too. The advisory doesn’t spell out the fixed versions on its main page, so open the Java and MySQL risk matrices before you upgrade.

This also isn’t the only Java-related story this month. If you missed the weak-key scare, our eMudhra certificate guide covers what to update.

What Java and MySQL users should check

These two products reach the most people, so they deserve a closer look. The table below shows the versions the advisory lists as affected, which means anything in these ranges needs an upgrade.

If you aren’t sure what you run, check from a terminal. Typing java -version shows your Java build, and mysql --version shows your MySQL release. Compare the result with the risk matrix for your product.

Don’t forget the quiet installs. Old Java copies often hide inside build servers, kiosk machines and bundled apps, and they rarely get updated on their own. A quick inventory now saves a scramble later.

How to roll out the patches without surprises

Oracle warns that attackers have successfully exploited bugs that already had patches available. In other words, the risk grows the longer a fix sits unapplied. A sensible order keeps both speed and safety in check:

1. List every Oracle product you run, including old Java installs on desktops.
2. Rank them by exposure, with internet-facing systems first.
3. Test the patch on a non-production copy.
4. Roll out in small batches and keep a rollback plan.

Testing matters because big patch sets can change behavior in older apps. If you can’t patch right away, Oracle says workarounds like blocking protocols or limiting privileges can help for a while, but they are not long-term fixes.

Microsoft’s monthly release was also huge this cycle. Our October 2026 Patch Tuesday breakdown shows how to line up both rollouts, and the GitLab CVE-2026-97229 post is a good example of a flaw that couldn’t wait.

Frequently Asked Questions

Is the Oracle October 2026 CPU being exploited right now?

Oracle has not flagged any of these flaws as exploited. It does say it periodically sees exploitation attempts against its products, and that attackers have gone after old bugs with available fixes.

When is the next Oracle security update?

The next quarterly CPU is due January 19, 2027. Smaller Critical Security Patch Updates are planned for November 17 and December 15, 2026, per SecurityWeek.

Do home users need to worry about it?

Mostly if you have Java installed or run MySQL locally. Most of the big counts are for business software like E-Business Suite and PeopleSoft, which home users rarely run.

Where do I download the patches?

Oracle publishes them through its support portal. The advisory page links each product’s risk matrix and patch notes.

My take: don’t try to patch everything at once. Fix what faces the internet this week, then work down the list, and put the November and December dates in your calendar now. A huge quarterly release is far easier to handle with a ranked list than with panic.