Oracle patches 1,295 flaws and six are critical: check your ERP now

Oracle has published its October Critical Patch Update Advisory with a volume that demands attention: 1,295 vulnerabilities fixed, of which six reach the maximum score of 10 on the CVSS 3.1 scale. This is not a minor bulletin or a notice that can wait until next quarter. If your company depends on Oracle E-Business Suite, SOA Suite, Access Manager or JD Edwards, this patch should already be on the IT team's priority list.

Which flaws concentrate the risk

The most striking thing is that the vulnerabilities with a perfect score are not in secondary products, but in components that many SMBs have in production and that support critical business processes. These are the ones you should review first:

• Oracle E-Business Suite (CVE-2026-101809): affects the Workflow component, in versions 12.2.3 to 12.2.15. An unauthenticated attacker with network access via HTTP could compromise the workflow notification system and take control of it, with potential impact on other connected products.
• Oracle SOA Suite (CVE-2026-91231): in the Adapters component, allows an unauthenticated attacker to take control of the suite and affect connected products.
• Oracle SOA Suite, Fabric layer (CVE-2026-91216 and CVE-2026-91221): both rated as easily exploitable and accessible via T3 or IIOP, in versions 12.2.1.4.0 and 14.1.2.0.0.
• Oracle Access Manager (CVE-2026-87337): exposes unauthorized creation, deletion or modification of critical data in versions 12.2.1.4.0 and 14.1.2.1.0.
• JD Edwards EnterpriseOne Orchestrator (CVE-2026-91299): allows an unauthenticated attacker to take control of versions 9.2.0.0 to 9.2.26.5.

The pattern repeats in almost all cases: no authentication is required, network access is enough. That drastically lowers the entry barrier for an attacker and turns these flaws into attractive targets for automated scans.

Why this matters more in an SMB

In a large corporation, a critical flaw in SOA Suite triggers a committee, a contingency plan and a dedicated team. In an SMB, the usual situation is that the ERP or integration middleware was set up by an external partner, that no one has a clear inventory of versions and that the maintenance window depends on when the business can be stopped. And that is the problem: these flaws do not wait for you to have a gap in your schedule.

There is a detail worth emphasizing: several of the affected products act as an integration hub between applications. Workflow, SOA Suite or Access Manager are not isolated systems; they are the plumbing through which orders, approvals and identity data flow. If an attacker takes control of that layer, the impact is not limited to the patched product: it spreads to everything that hangs from it. It is the same domino effect we see in other environments when a central component fails, as happens with the hidden flaws that bring down the Kubernetes control plane.

What we recommend doing this week

There is no need to turn this into a three-month project. With an orderly approach, the most urgent risk can be closed in a few days:

1. Express inventory: locate which instances of E-Business Suite, SOA Suite, Access Manager and JD Edwards you have, in which versions and who maintains them. If you don't know, that is the first problem to solve.
2. Check exposure: identify whether those components are accessible from the internet or from third-party networks. A flaw with CVSS 10 in a closed system is serious; exposed, it is an emergency.
3. Patch by priority: first the six critical ones, then the rest of the bulletin. Do not wait to group everything into a single window if you can bring forward the most exposed.
4. Mitigate while you patch: if you cannot apply the patch immediately, restrict network access to the ports and protocols involved (HTTP, T3, IIOP) and review logs for anomalous access.
5. Verify afterwards: an applied patch is not always an effective patch. Confirm the version, restart services and validate that the exposed surface has changed.

The context: AI accelerates flaw discovery

Patch volumes like this will stop being exceptional. AI is making it possible to discover vulnerabilities at a pace that was previously unthinkable, and that translates into larger and more frequent bulletins. We commented on this following Altman's words about 50-year-old flaws that AI is uncovering: the bottleneck is no longer finding the flaw, but managing the fix.

For an SMB, the practical conclusion is clear: patch management stops being a reactive task and becomes a continuous process. If your IT team only remembers to update when there is a scare, this pace will overwhelm you. It is worth setting up a minimum monthly review cycle, with an assigned owner and a record of what has been applied. You don't need your own SOC for that; you do need discipline and, if there is not enough internal team, a partner that responds with clear deadlines.

Oracle has not published active exploits in this bulletin, but experience says that flaws with CVSS 10 and remote exploitation without authentication end up appearing in mass scans within weeks. The window to act without haste is short. Take advantage of whatever margin you have and do not turn this bulletin into the next incident that has to be put out with the business stopped.

Source: Computerworld. Analysis and adaptation: ForgeNEX.