Oracle's October 2026 Critical Patch Update: 1,295 Patches, None for Out-of-Support Versions

By Scott Bissett  ·  Published: October 21, 2026  ·  Reference guide  ·  Every count and version range read twice on the day of publication from Oracle's October 2026 advisory (raw HTML and in a browser); support dates are the ones this site serves, re-checked at every build; the KEV check is against CISA's catalog of October 21, 2026.

Oracle released its October 2026 Critical Patch Update on October 20, 2026, with 1,295 new security patches, per Oracle's October 2026 advisory. As every quarter, the advisory covers only releases in Premier Support or Extended Support. Oracle Database 18c, 12.2, 12.1 and 11.2, MySQL 8.0, WebLogic 12.1 and VirtualBox 7.1 are not in it. That is not a finding that they are safe: Oracle says releases outside those phases are "not tested for the presence of vulnerabilities" this update addresses, and that earlier versions of affected releases are likely affected too. This guide is the October companion to our July 2026 CPU analysis.

The 1,295 patches by product family

Oracle's per-family counts, which sum to the 1,295 total. Several families also carry third-party component patches that Oracle notes separately.

Which versions were patched, and which were not

The middle column is Oracle's own: the versions each risk matrix lists as affected, which Oracle limits to supported versions. The right column is the release lines of the same product that are past support and so absent, with the date this site serves.

Two supported lines with a near end date. Oracle Database 21c is in this advisory, and its served end of support is July 31, 2027, with no Extended Support in our data. WebLogic 12.2.1.4 is in it too; its served end of Premier Support is December 31, 2026, with Extended Support to December 31, 2027.

Java SE: what the 55 patches cover

The Java SE matrix lists Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 as affected. Three details matter:

• JDK 26 got no fix. 26.0.2 appears in the matrix, but Oracle's JDK 26 release notes list no update after 26.0.2, and Oracle's Java SE support roadmap ended JDK 26's Premier Support in September 2026, with no Extended Support. A JDK 26 install needs to move to JDK 27 or to JDK 25.
• JDK 17 is now in Extended Support. Oracle's roadmap moved Oracle JDK 17 from Premier to Extended Support in September 2026, with Extended Support to September 2029. October is the first CPU since that change.
• JDK 8 and 11 stay in Extended Support, to December 2030 and January 2032 on Oracle's roadmap. See the Oracle JDK page for every line.

MySQL: 8.0 is absent for the second quarter

MySQL Server 8.0 reached end of life on April 30, 2026, and the October advisory lists MySQL Server only at 8.4, 9.7 and 26.7. The 98 MySQL patches therefore include nothing for an 8.0 server. The MySQL Cluster entry is the exception in the family: it still lists 8.0 releases, up to 8.0.49. The supported MySQL Server lines, including MySQL 8.4, are on the MySQL page.

The rule, unchanged

Under its supported-products section, Oracle's October advisory repeats the policy the July advisory set out: Critical Patch Update patches are provided only for product versions in Premier Support or Extended Support under Oracle's Lifetime Support Policy. Releases outside those phases are not tested, Oracle expects earlier versions of affected releases to be affected as well, and it recommends upgrading to supported versions. A version's absence from the advisory is the absence of a test result, not a clean result. Our July analysis covers what Sustaining Support does and does not include.

Known exploited: none of Oracle's own October CVEs yet

As of CISA's Known Exploited Vulnerabilities catalog of October 21, 2026, no Oracle CVE in the October advisory is listed. The advisory's patches also address third-party component CVEs, and three of those were already in KEV before October 20: CVE-2026-34486 and CVE-2025-24813 in Apache Tomcat, and CVE-2023-44487, the HTTP/2 Rapid Reset flaw. Oracle lists all three as additionally addressed by patches for Oracle Communications products.

Next dates in Oracle's advisory

Oracle's October advisory says security patches are now released on the third Tuesday of each month, and prints the next four dates: monthly releases (labelled CSPU) on 17 November 2026 and 15 December 2026, the next quarterly Critical Patch Update on 19 January 2027, and a CSPU on 16 February 2027.

What to do

1. Apply the October patches to every supported Oracle release, starting with internet-facing Fusion Middleware, E-Business Suite and PeopleSoft.
2. List what is not in the advisory. Any Oracle Database 18c, 12.2, 12.1 or 11.2, MySQL 8.0, WebLogic 12.1 or VirtualBox 7.1 system got nothing in October and will get nothing in January.
3. Plan the two near ends: WebLogic 12.2.1.4 Premier Support (December 31, 2026) and Oracle Database 21c (July 31, 2027).
4. Check each version with the EOL Checker, or a whole estate with the scanner.

Frequently Asked Questions

Related

• Oracle's July 2026 CPU — 1,449 patches, and what out-of-support versions miss
• Oracle Database lifecycle guide — every release and its support phases
• MySQL end of life — 8.0, 8.4 and the Innovation releases