Oracle Closes 1295 Security Vulnerabilities in October Update

On October 18, 2026, Oracle released its regular Critical Patch Update (CPU), closing a total of 1295 security vulnerabilities. This is only slightly fewer than the record number of 1300 vulnerabilities addressed in July 2026. The software vendor attributes the high number of vulnerabilities to the increasing use of artificial intelligence for discovering security flaws. In addition to the quarterly CPU updates, Oracle has introduced monthly security updates since April 2026, referred to as Critical Security Patch Updates (CSPU).

These updates continue to be released on the third Tuesday of each month and are intended to enhance the security of products between regular CPU updates. In the area of Java SE, 55 vulnerabilities were closed, with the highest CVSS score being 7.5. Of these vulnerabilities, 49 are exploitable over the network without user authentication. Furthermore, more than 50 additional CVEs are listed in the footnotes that are not included in the main list. The latest version of Java, Java 27, was released in September 2026 and receives its first security update with v27.0.1.

Java 25, which is considered a Long Term Support (LTS) version, will be supported until summer 2033. The current LTS versions are Java 25, 21, 17, and 11, with Java 11 receiving updates until 2032. For commercial users of Java 21, a paid license will be required starting October 2026, while usage for private users and developers remains free. Java 25 will become a paid version for commercial users starting October 2028. In the area of VirtualBox, Oracle has fixed six vulnerabilities, with a maximum CVSS score of 8.4.

However, none of these vulnerabilities are exploitable over the network. Some of the vulnerabilities could allow attackers to execute code from the virtual machine on the host system. The latest version of VirtualBox is 7.2.22. Security updates have also been provided for the MySQL database, although they are not detailed. Oracle recommends regularly updating all products to minimize security risks.

The vulnerabilities addressed in the updates affect a wide range of industry solutions offered by Oracle. A comprehensive list of CVEs is available on the company's website. Oracle plans to introduce monthly security updates for Java starting in 2027 to continuously improve software security. The latest version of Java 8, Update 511, includes 18 fixed vulnerabilities and remains free for private users and developers. The security vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany, according to the BSI.