Oracle Releases October 2026 Critical Patch Update With 109 PeopleSoft Fixes Alone

Scope: Oracle Database, E-Business Suite, PeopleSoft, Oracle Communications, Oracle Analytics, Oracle Systems, and other Oracle product lines

Severity: Red

Oracle’s October 2026 Critical Patch Update went live today, covering 13 new patches for Database products, 109 for PeopleSoft, 124 for Oracle Communications, 33 for Oracle Analytics, and smaller counts across APEX, Essbase, GoldenGate, NoSQL Database, Secure Backup, SQL Developer, Commerce, Systems, and Virtualization. PeopleSoft is worth flagging on its own given it has already been exploited as a zero-day earlier this year and continues to see renewed mass exploitation attempts from ShinyHunters-linked actors, so this release lands in an environment where attackers are already actively probing the platform. Oracle quarterly CPUs are dense by design and easy to deprioritise simply because of their size, but any organisation running Oracle Database, E-Business Suite, or PeopleSoft should treat today’s release as a priority review rather than routine maintenance. Organisations must review the full advisory against every Oracle product in their environment and apply patches, prioritising any Oracle system that is internet-facing or holds sensitive data, with PeopleSoft and E-Business Suite first given their exploitation history this year.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.