Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale.
The company’s flagship Oracle E-Business Suite was home to one of the vulnerabiltiies, tracked as CVE-2026-101809. This enables any unauthenticated attacker with network access via HTTP to compromise the workflow notification mailer in the suite’s Workflow component, taking over Workflow and potentially affecting other products too. The flaw affects Workflow versions 12.2.3 through 12.2.15.
Oracle SOA Suite, part of Oracle Fusion Middleware, was hit by three of the bugs rated 10.0.
One, tracked as CVE-2026-91231, is in the Adapters component, and enables unauthenticated attackers to compromise Oracle SOA Suite resulting in its takeover, with potential impact on connected products.
Two others were in the Fabric Layer component of Oracle SOA Suite: CVE-2026-91216 and CVE-2026-91221.
Both are easily exploitable, Oracle said, and enable an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise Oracle SOA Suite and perhaps affect other products too. The bugs appear in supported versions 12.2.1.4.0 and 14.1.2.0.0.
There’s a 10.0-rated vulnerability in another part of Oracle Fusion Middleware too. The flaw in Oracle Access Manager (tracked as CVE-2026-87337 leaves it open to compromise by any unauthenticated attacker with network access via HTTP. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification of critical data on Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.
The last “perfect 10” vulnerability in Oracle’s latest report is in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards, tracked as CVE-2026-91299. This enables an unauthenticated attacker with network access via HTTP to compromise and take over versions 9.2.0.0 through 9.2.26.5 of the orchestrator.