Oracle October 2026 CPU — the numbers that actually matter:
1,295 patches / 1,209 CVEs (not 1,283 — that's the wrong figure)
~590 patches for unauthenticated flaws
Six CVSS 10.0s, all unauth
The 9.8 to patch first: CVE-2026-101767 — EBS SQL injection with a published Horizon3 chain that bypasses the default URL firewall and reaches a shell via the Concurrent Manager.
CVE-2026-35273 (PeopleSoft, KEV): ShinyHunters / UNC6240 are URL-encoding the PSEMHUB path to bypass WAF blocks. Patch, don't WAF.
https://threataft.com/articles/oracle-october-2026-cpu-1209-cves-six-cvss-10
ThreatAftOracle October 2026 CPU: 1,209 CVEs, Six 10.0s | ThreatAftOracle's October 2026 CPU fixes 1,209 CVEs across 33 families, including six CVSS 10.0 flaws. Patch Fusion Middleware, EBS and PeopleSoft first.