Oracle patches scores of Java SE flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Oracle's October 2026 CPU fixes over 100 vulnerabilities in Java SE, GraalVM and JavaFX, some allowing remote code execution or data exposure.
CERT-FR has relayed Oracle's Critical Patch Update of 20 October 2026 (cpuoct2026), which addresses a very large number of vulnerabilities across Oracle Java SE (versions 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27), Oracle GraalVM Enterprise Edition and GraalVM for JDK, and Oracle JavaFX. The advisory lists well over a hundred CVE references without per-CVE descriptions, but states that some of the flaws can be exploited remotely to achieve arbitrary code execution, denial of service, and breaches of data confidentiality and integrity, as well as security-policy bypass.
No exploitation in the wild is mentioned in the advisory; this is a routine (if unusually large) quarterly patch release. CERT-FR's guidance is standard: consult Oracle's official CPU bulletin for the full CVE-to-product mapping and apply the vendor-supplied patches to all affected Java SE, GraalVM and JavaFX deployments. Given the breadth of affected versions and the presence of remotely exploitable RCE-class issues, organizations running Oracle Java SE or GraalVM in production — particularly internet-facing or multi-tenant JVM services — should prioritize patch testing and deployment according to their exposure.
Defenders should inventory all Java SE/GraalVM/JavaFX installations against the affected-version list, track patch deployment status, and monitor Oracle's bulletin for any later confirmation of active exploitation, since CERT-FR advisories are updated if that status changes.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1350
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,960 reports from 143 sources, 519 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs