Oracle's October CPU: six 10.0s, and why T3 is still answering on your perimeter

Oracle released its October 2026 Critical Patch Update on October 20, addressing 1,295 vulnerabilities across its product families. Six of these vulnerabilities were rated 10.0 on the CVSS v3.1 scale, all of which are remotely exploitable without authentication and have a changed security scope. This means a compromise of one component can affect others.

For most organizations, the update is routine as it follows a quarterly cycle already in place. The key question is which parts of the environment make the 10.0 vulnerabilities reachable. Several depend on protocol endpoints like T3 and IIOP that are left open by decades of firewall practice.

Of the six 10.0 vulnerabilities, all are remotely exploitable. They affect various Oracle products including E-Business Suite, SOA Suite, SOA Suite Adapters, Access Manager, JD Edwards EnterpriseOne Orchestrator, and WebLogic Server. The 10.0 entries are in Workflow Notification Mailer, Fabric Layer, Adapters, Access Manager authentication engine, and E-Business Suite Application Object Library. The 9.8 entries are in E-Business Suite and Oracle APEX.

The network control of these vulnerabilities is more significant than usual because T3 and IIOP are not typically inspected by web application firewalls (WAFs) or firewalls. So, an environment where these protocols are reachable only from specific management hosts is not exploitable through the network path these CVEs describe. The corollary is that environments exposing T3 or IIOP to a broader range need to treat the patch as an emergency rather than a quarterly item.

Before patching, important questions to answer include which WebLogic domains and versions are affected, whether SOA Suite is present, and if APEX instances are tracked separately from the database. The "scope changed" vector implies that containing a compromise requires treating the component's credentials as exposed, which means changing data source passwords, JMS destinations, keystores, and administrative credentials.

Oracle advises applying the CPU to internet-reachable and T3-exposed systems first, then restricting T3 and IIOP at the network layer for everything else.