Oracle Critical Patch Update Advisory

Oracle Critical Patch Update Pre-Release Announcement - October 2026

Description

This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for October 2026, which will be released on Tuesday, October 20, 2026. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory.

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. This Critical Patch Update addresses 1283 new security patches. Some of the vulnerabilities addressed in this Critical Patch Update affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update patches as soon as possible.

Executive Summaries

Oracle Database Server Executive Summary

This Critical Patch Update contains 13 new security patches for Oracle Database Products. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 1 of these patches is applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Database Server is 8.8.

The Oracle Database Server components and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Database Server, versions 19.3-19.32, 21.3-21.23, 23.4.0-23.26.3

Oracle APEX Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle APEX. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle APEX is 9.8.

The Oracle APEX products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle APEX, versions 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4

Oracle Autonomous Health Framework Executive Summary

This Critical Patch Update contains 6 new security patches for Oracle Autonomous Health Framework. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Autonomous Health Framework is 9.8.

The Oracle Autonomous Health Framework products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Autonomous Health Framework, versions 26.3-26.8

Oracle Essbase Executive Summary

This Critical Patch Update contains 38 new security patches for Oracle Essbase. 14 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Essbase is 9.9.

The Oracle Essbase products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Essbase, version 21.8.3.0.0

Oracle Global Lifecycle Management Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle Global Lifecycle Management. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Global Lifecycle Management is 6.8.

The Oracle Global Lifecycle Management products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Global Lifecycle Management OPatch, versions 12.2.0.1.16-12.2.0.1.52
Oracle Global Lifecycle Management OPatchAuto, versions 12.2.0.1.16-12.2.0.1.52

Oracle GoldenGate Executive Summary

This Critical Patch Update contains 11 new security patches for Oracle GoldenGate. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle GoldenGate is 8.8.

The Oracle GoldenGate products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle GoldenGate, versions 19.1.0.0.0-19.32.0.0, 21.3-21.23, 23.4-23.26.3.0.0
Oracle GoldenGate Big Data and Application Adapters, versions 21.3-21.20, 23.4-23.26.1
Oracle GoldenGate Stream Analytics, versions 19.1.0.0.0-19.1.0.0.16, 26.1.0.0.0-26.2.0.0.1
Oracle Management Pack for Oracle GoldenGate, versions 13.4.1.0.1-13.5.2.0.6

Oracle NoSQL Database Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle NoSQL Database. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle NoSQL Database is 7.5.

The Oracle NoSQL Database products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle NoSQL Database, versions 1.8.0, 23.3.41, 24.4.14, 25.3.24

Oracle REST Data Services Executive Summary

This Critical Patch Update contains 35 new security patches for Oracle REST Data Services. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle REST Data Services is 8.8.

The Oracle REST Data Services products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle REST Data Services, versions 24.2.0-26.2.2

Oracle Secure Backup Executive Summary

This Critical Patch Update contains 7 new security patches for Oracle Secure Backup. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Secure Backup is 9.8.

The Oracle Secure Backup products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Secure Backup, versions 19.1.0.0.0, 19.1.0.1.0

Oracle SQL Developer Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle SQL Developer. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle SQL Developer is 7.5.

The Oracle SQL Developer products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle SQL Developer, versions 23.1.1-26.1.0

Oracle TimesTen In-Memory Database Executive Summary

This Critical Patch Update contains 4 new security patches for Oracle TimesTen In-Memory Database. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle TimesTen In-Memory Database is 7.8.

The Oracle TimesTen In-Memory Database products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle TimesTen In-Memory Database, versions 22.1-22.1.40.0, 26.1-26.1.1.3.0

Oracle Trusted Answer Search Executive Summary

This Critical Patch Update contains 8 new security patches for Oracle Trusted Answer Search. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Trusted Answer Search is 9.9.

The Oracle Trusted Answer Search components and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Trusted Answer Search, version 26.1

Oracle Application Testing Suite Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle Application Testing Suite. Neither of these vulnerabilities may be remotely exploitable without authentication, i.e., neither may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Application Testing Suite is 7.8.

The Oracle Application Testing Suite components and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Application Testing Suite, version 13.3.0.1

Oracle Commerce Executive Summary

This Critical Patch Update contains 3 new security patches for Oracle Commerce. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Commerce is 7.1.

The Oracle Commerce products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Commerce Platform, version 11.4.0

Oracle Communications Executive Summary

This Critical Patch Update contains 124 new security patches for Oracle Communications. 87 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Communications is 9.8.

The Oracle Communications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Communications Billing and Revenue Management, versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0
Oracle Communications BRM - Elastic Charging Engine, versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0
Oracle Communications Cloud Native Core Binding Support Function, versions 25.2.200, 25.2.201
Oracle Communications Cloud Native Core Certificate Management, versions 25.2.201, 26.1.200
Oracle Communications Cloud Native Core Console, versions 25.2.202, 26.1.200
Oracle Communications Cloud Native Core Network Repository Function, versions 25.2.202, 26.1.200, 26.1.202
Oracle Communications Cloud Native Core Network Slice Selection Function, version 25.2.200
Oracle Communications Cloud Native Core Policy, versions 24.2.4-25.2.0, 25.2.200
Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 25.2.200, 25.2.201, 25.2.202, 26.1.200
Oracle Communications Cloud Native Core Service Communication Proxy, versions 25.1.100, 25.1.200, 25.2.100, 26.1.100
Oracle Communications Cloud Native Core Unified Data Repository, versions 25.1.200, 25.2.200, 26.1.200
Oracle Communications EAGLE Element Management System, version 47.0.0.2.0
Oracle Communications EAGLE LNP Application Processor, version 11.0
Oracle Communications LSMS, version 14.0
Oracle Communications Network Analytics Data Director, versions 25.1.200, 25.2.100, 25.2.200
Oracle Communications Operations Monitor, versions 6.0, 6.1
Oracle Communications Policy Management, versions 15.0.0.0.0, 15.1.0.0.0
Oracle Communications Service Catalog and Design, versions 8.0-8.3
Oracle Communications Unified Assurance, versions 6.1.1-7.0.0
Oracle Communications Unified Inventory Management, versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1

Oracle Construction and Engineering Executive Summary

This Critical Patch Update contains 11 new security patches for Oracle Construction and Engineering. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Construction and Engineering is 8.1.

The Oracle Construction and Engineering products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Primavera Gateway, versions 21.12.0-21.12.18
Primavera Unifier, versions 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16, 25.12.0-25.12.9

Oracle E-Business Suite Executive Summary

This Critical Patch Update contains 196 new security patches for Oracle E-Business Suite. 34 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle E-Business Suite is 10.0.

The Oracle E-Business Suite products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle E-Business Suite, versions 12.2.3-12.2.15

Oracle Enterprise Manager Executive Summary

This Critical Patch Update contains 12 new security patches for Oracle Enterprise Manager. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Enterprise Manager is 9.9.

The Oracle Enterprise Manager products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Enterprise Manager Base Platform, versions 13.5, 24.1
Oracle Enterprise Manager for Oracle Database, versions 13.5, 24.1
Oracle Enterprise Manager for Siebel, versions 13.5, 24.1
Oracle Enterprise Manager for Virtualization, version 13.5

Oracle Financial Services Applications Executive Summary

This Critical Patch Update contains 4 new security patches for Oracle Financial Services Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Financial Services Applications is 8.1.

The Oracle Financial Services Applications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.7.9.0, 8.0.8.7.0, 8.1.2.5.0, 8.1.2.6.0
Oracle Financial Services Behavior Detection Platform, versions 8.0.8.1, 8.1.2.11, 8.1.2.12
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, version 8.0.8.0

Oracle Fusion Middleware Executive Summary

This Critical Patch Update contains 196 new security patches for Oracle Fusion Middleware. 132 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Fusion Middleware is 10.0.

The Oracle Fusion Middleware products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Helidon, versions 3.0.0-3.2.21, 4.0.0-4.5.5, 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 27.0.0
Oracle Access Manager, versions 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0
Oracle Business Process Management Suite, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0
Oracle Data Integrator, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Fusion Middleware, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Fusion Middleware Control, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Global Lifecycle Management NextGen OUI Framework, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0, 15.1.1.0.0
Oracle HTTP Server, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Identity Manager, versions 12.2.1.4.0, 14.1.2.1.0
Oracle Identity Manager Connector, versions 12.2.1.4.0, 14.1.2.1.0
Oracle JDeveloper, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Managed File Transfer, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Middleware Common Libraries and Tools, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Oracle Outside In Technology, version 8.5.8
Oracle Service Bus, versions 12.2.1.4.0, 14.1.2.0.0
Oracle SOA Suite, versions 12.2.1.4.0, 14.1.2.0.0
Oracle Web Services Manager, version 14.1.2.0.0
Oracle WebCenter Content, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Portal, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebCenter Sites, versions 12.2.1.4.0, 14.1.2.0.0
Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Oracle Weblogic Server Proxy Plug-in, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
WebCenter Content: Imaging, versions 12.2.1.4.0, 14.1.2.0.0

Oracle Analytics Executive Summary

This Critical Patch Update contains 33 new security patches for Oracle Analytics. 14 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Analytics is 9.1.

The Oracle Analytics products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle BI Publisher, versions 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0
Oracle Business Intelligence Enterprise Edition, versions 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0

Oracle HealthCare Applications Executive Summary

This Critical Patch Update contains 4 new security patches for Oracle HealthCare Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle HealthCare Applications is 9.8.

The Oracle HealthCare Applications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Health Sciences Information Manager, versions 4.0.0-4.0.3
Oracle Healthcare Data Repository, versions 8.2.0.0-8.2.0.8
Oracle Healthcare Master Person Index, versions 5.0.0.0-5.0.9.7

Oracle Hospitality Applications Executive Summary

This Critical Patch Update contains 4 new security patches for Oracle Hospitality Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Hospitality Applications is 7.5.

The Oracle Hospitality Applications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Hospitality Cruise Shipboard Property Management (SPMS), versions 23.1, 23.2, 23.3
Oracle Hospitality OPERA 5 Property Services, versions 5.6.28.0, 5.6.28.2

Oracle Java SE Executive Summary

This Critical Patch Update contains 55 new security patches for Oracle Java SE. 49 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Java SE is 7.5.

The Oracle Java SE products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle GraalVM Enterprise Edition, version 21.3.19.1.1
Oracle GraalVM for JDK, versions 17.0.20.1, 21.0.12.1
Oracle Java SE, versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27
Oracle JavaFX, versions 21.0.12, 25.0.4, 27

Oracle JD Edwards Executive Summary

This Critical Patch Update contains 102 new security patches for Oracle JD Edwards. 44 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle JD Edwards is 10.0.

The Oracle JD Edwards products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

JD Edwards EnterpriseOne Configurator, version 9.2
JD Edwards EnterpriseOne General Ledger, version 9.2
JD Edwards EnterpriseOne Homebuilder, version 9.2
JD Edwards EnterpriseOne Human Resources Management, version 9.2
JD Edwards EnterpriseOne Localizations, version 9.2
JD Edwards EnterpriseOne Operational Sourcing, version 9.2
JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0-9.2.26.5
JD Edwards EnterpriseOne Sales Order Entry, version 9.2
JD Edwards EnterpriseOne Tools, versions 9.2.0.0-9.2.26.5

Oracle MySQL Executive Summary

This Critical Patch Update contains 98 new security patches for Oracle MySQL. 29 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle MySQL is 9.8.

The Oracle MySQL products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

MySQL Client, versions 8.0.0-8.0.48, 8.4.0-8.4.11, 9.7.0-9.7.2, 26.7.0
MySQL Cluster, versions 9.7.2, 26.7.0
MySQL Connectors, versions 26.7.0, 26.7.1
MySQL Enterprise Backup, versions 8.0.0-8.0.48, 8.4.0-8.4.11, 9.7.0-9.7.2, 26.7.0
MySQL Router, versions 26.7.0-27.10.0
MySQL Server, versions 8.0.0-8.0.48, 8.4.0-8.4.11, 9.7.0-9.7.2, 26.7.0
MySQL Server, MySQL Cluster, versions 8.0.0-8.0.48, 8.4.0-8.4.11, 9.7.0-9.7.2, 26.7.0

Oracle PeopleSoft Executive Summary

This Critical Patch Update contains 109 new security patches for Oracle PeopleSoft. 41 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle PeopleSoft is 9.8.

The Oracle PeopleSoft products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

PeopleSoft Enterprise CC Common Application Objects, version 9.2
PeopleSoft Enterprise FIN Cash Management, version 9.2
PeopleSoft Enterprise FIN Common Objects Argentina, version 9.1
PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
PeopleSoft Enterprise FIN General Ledger Brazil, version 9.1
PeopleSoft Enterprise FIN Inventory Brazil, version 9.1
PeopleSoft Enterprise FIN Manufacturing Brazil, version 9.1
PeopleSoft Enterprise FIN Product Configurator Brazil, version 9.1
PeopleSoft Enterprise HCM Global Payroll Switzerland, version 9.2
PeopleSoft Enterprise HCM Human Resources, version 9.2
PeopleSoft Enterprise PeopleTools, versions 8.61-8.63
PeopleSoft Enterprise SCM Manufacturing, version 9.2
PeopleSoft Enterprise SCM Purchasing, version 9.2
PeopleSoft Enterprise SCM Strategic Sourcing, version 9.2

Oracle Retail Applications Executive Summary

This Critical Patch Update contains 5 new security patches for Oracle Retail Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Retail Applications is 8.1.

The Oracle Retail Applications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Retail Merchandise Financial Planning, versions 15.0, 16.0
Oracle Retail Merchandising System, version 19.0.1.44
Oracle Retail Predictive Application Server, versions 15.0.3.190, 16.0.3.350
Oracle Retail Xstore Point of Service, versions 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1, 26.0.0

Oracle Siebel CRM Executive Summary

This Critical Patch Update contains 123 new security patches for Oracle Siebel CRM. 67 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Siebel CRM is 9.9.

The Oracle Siebel CRM products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Siebel Applications, versions 17.0-26.9

Oracle Supply Chain Executive Summary

This Critical Patch Update contains 50 new security patches for Oracle Supply Chain. 19 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Supply Chain is 9.3.

The Oracle Supply Chain products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Agile Engineering Data Management, version 6.2.1
Oracle Agile PLM, versions 2.6, 9.3.6
Oracle Agile PLM MCAD Connector, version 3.6
Oracle Agile Product Lifecycle Management for Process, version 6.2.4
Oracle Demand Planning, versions 12.1, 12.2
Oracle Product Lifecycle Analytics, version 3.6.1

Oracle Systems Executive Summary

This Critical Patch Update contains 16 new security patches for Oracle Systems. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Systems is 9.8.

The Oracle Systems products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Solaris, versions 10, 11.3, 11.4
Oracle ZFS Storage Appliance Kit, version 8.8

Oracle Utilities Applications Executive Summary

This Critical Patch Update contains 4 new security patches for Oracle Utilities Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Utilities Applications is 7.5.

The Oracle Utilities Applications products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle Utilities Network Management System, versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10, 25.12.0.0.0-25.12.0.0.2

Oracle Virtualization Executive Summary

This Critical Patch Update contains 2 new security patches for Oracle Virtualization. Neither of these vulnerabilities may be remotely exploitable without authentication, i.e., neither may be exploited over a network without requiring user credentials.

The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle Virtualization is 7.8.

The Oracle Virtualization products and versions affected by vulnerabilities that are addressed in this Critical Patch Update are:

Oracle VM VirtualBox, version 7.2.20