Oracle’s October 2026 Critical Patch Update contains 1295 new security patches across its product families, according to the company’s advisory.
The advisory lists affected products that include MySQL Server, MySQL Cluster, MySQL Router, Oracle Access Manager, Oracle APEX, BI Publisher, JD Edwards EnterpriseOne, Oracle Coherence and Oracle Communications Cloud Native Core components. Each row points to a patch availability document. Oracle repeats its standing warning that attackers have succeeded where customers failed to apply available patches, and urges customers to stay on supported versions and patch without delay.
Counts differ by source. Tenable’s October 20 write-up put the release at 1209 CVEs, while Oracle counts 1295 patches. A patch and a CVE are different units, so teams comparing vendors should not treat the two figures as a disagreement about the same thing. For patch planning, the Oracle risk matrices decide scope, because they name the version ranges that apply.
The size of the release is the story for exposure teams. In July, Oracle’s patch load nearly tripled, and October continues at that scale. Teams that triage by count will drown, which echoes the argument in A 1,400-Plus-CVE Release Shows Why the CVE Count Should Not Set Your Priorities. Start with an inventory of which Oracle product families run in your estate, then read only those risk matrices and rank by exposure to the internet.
Source: Oracle, Critical Patch Update Advisory, October 2026
