Oracle published its October 2026 Critical Patch Update on the night of 20 October, covering 1,295 vulnerabilities across its product families. The CVEs were synchronised to NVD and to national vulnerability databases the following day. Among them are six scored 10.0 under CVSS v3.1, all remotely exploitable without authentication, and all with a changed security scope, meaning a compromise of one component is expected to affect others.
For most organisations the update lands in a quarterly cycle that has been running for years. The interesting question is not whether to apply it but which parts of the estate make the 10.0s reachable, because several depend on protocol endpoints that decades of firewall practice have left open.

The 10.0 entries

CVE-2026-101809 affects Oracle E-Business Suite, in the Workflow Notification Mailer component, versions 12.2.3 through 12.2.15. An unauthenticated attacker with HTTP network access can take over Workflow, and Oracle notes that attacks may significantly impact additional products. NVD records the CVSS v3.1 base score as 10.0 with the scope-changed vector.
CVE-2026-91216 and CVE-2026-91221 affect Oracle SOA Suite, in the Fabric Layer component, versions 12.2.1.4.0 and 14.1.2.0.0. Both are reached over T3 and IIOP.
CVE-2026-91231 affects the SOA Suite Adapters component over HTTP.
CVE-2026-87337 affects Oracle Access Manager's authentication engine over HTTP, versions 12.2.1.4.0 and 14.1.2.1.0.
CVE-2026-91299 affects Oracle JD Edwards EnterpriseOne Orchestrator over HTTP, versions 9.2.0.0 through 9.2.26.5.
Below that tier sit entries that would headline a normal month. CVE-2026-83399 and CVE-2026-91323 affect WebLogic Server Core at 9.8: the first over T3 and IIOP, the second over HTTP, both allowing an unauthenticated network attacker to take over the server. Affected WebLogic versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. CVE-2026-101767 is a 9.8 in E-Business Suite's Application Object Library. CVE-2026-101521 is a 9.8 in Oracle APEX, affecting 24.1.0 through 24.1.21, 24.2.0 through 24.2.20 and 26.1.0 through 26.1.4.

The protocols are the control, not the patch

T3 and IIOP are the protocols WebLogic uses for remote administration and for EJB communication. They are not HTTP. They do not appear in web server access logs in a form most teams can read, they are rarely inspected by a WAF, and firewalls configured with "allow internal application tier to WebLogic" rules often permit them broadly.
Both 10.0 SOA Suite entries and both 9.8 WebLogic entries in this update use T3 or IIOP. That makes the network control more consequential than usual: an environment where T3 and IIOP are reachable only from the specific management hosts that need them is not exploitable through the network path these CVEs describe, regardless of patch timing.
The corollary is harsher. An environment that exposes T3 or IIOP to a broader range needs to treat the patch as an emergency rather than a quarterly item, because the pre-authentication requirement is the only barrier these CVEs have.

Inventory questions worth answering before the change window

Which WebLogic domains run which versions, and which ones are 12.2.1.3.0 or earlier? The 12.2.1.3.0 entry in Oracle's affected-products table is easy to overlook when the fixed-version list starts at 12.2.1.4.0.
Is SOA Suite present without anyone remembering it? Fusion Middleware installations frequently accumulate components over years, and a SOA Suite domain that was stood up for one integration project and never decommissioned is still a 10.0-bearing system.
Does anything still expose the E-Business Suite Workflow Notification Mailer over HTTP to a network wider than the mail relay it talks to? That component exists to process notifications, and its exposure requirements are narrower than the application as a whole.
Are APEX instances tracked separately from the database they sit on? APEX patches frequently follow the database patch cycle in people's mental model even when the APEX version lags.

What "scope changed" implies for containment

A scope-changed vector means the vulnerable component's compromise affects resources beyond its own security authority. For an application server that holds data source credentials, that is the ordinary state of affairs: taking over SOA Suite gives access to what SOA Suite can reach, including the databases behind its adapters.
That has a practical consequence for incident response planning. Containing a compromise of one of these components is not achieved by patching it. It requires treating the credentials the component holds as exposed, which for Fusion Middleware means data source passwords, JMS destinations, keystores and the administrative credentials for the domain.
Oracle notes in its advisory that it continues to receive reports of malicious exploitation of its vulnerabilities and that some have been successfully exploited, which is the standing language the company uses to justify keeping current on support contracts.

Where to spend the first hour

Apply the CPU to internet-reachable and T3-exposed systems first. Then restrict T3 and IIOP at the network layer for everything else, since that control costs nothing to implement and removes the reachable path for several of these entries at once.
Then check the systems that will be patched later. A legacy WebLogic domain on 12.2.1.3.0 with T3 open is the worst combination in this update and the least likely to appear on a modern inventory dashboard.

References

  • Oracle Critical Patch Update Advisory, October 2026

  • NVD entries for CVE-2026-101809, CVE-2026-91216, CVE-2026-91221, CVE-2026-91231, CVE-2026-87337, CVE-2026-91299, CVE-2026-83399, CVE-2026-91323, CVE-2026-101767 and CVE-2026-101521

  • Oracle Security Alerts and the patch availability documents linked from the CPU