Oracle’s October Critical Patch Update addresses 1,295 vulnerabilities, six of them rated 10.0 under CVSS 3.1. All six fall to an unauthenticated attacker who can reach the affected component over the network.
E-Business Suite carries one. CVE-2026-101809 sits in the Workflow component’s notification mailer, where an HTTP request is enough to seize Workflow and potentially reach connected products. Versions 12.2.3 through 12.2.15 are affected.
Three perfect scores in SOA Suite
Fusion Middleware hosts three of the maximum ratings. CVE-2026-91231 lands in the SOA Suite Adapters component. CVE-2026-91216 and CVE-2026-91221 hit the Fabric Layer. Oracle rates the last two as easily exploitable over T3 or IIOP, with versions 12.2.1.4.0 and 14.1.2.0.0 in scope.
Access Manager rounds out the middleware problems. CVE-2026-87337 allows an HTTP-based attacker to create, delete or modify critical data on versions 12.2.1.4.0 and 14.1.2.1.0.
The final 10.0 belongs to JD Edwards. CVE-2026-91299 lets an unauthenticated attacker take over EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5 over HTTP.
Where to start
A 1,295-flaw batch cannot be closed in a maintenance window. Tier the six maximum-severity items first, and close network paths to those four products from anything that is not a known integration partner. None of the six needs credentials, so an internet-reachable listener on any of them is the entire attack surface.
