# Oracle MySQL October 2026 CPU patches flaws

Published: 2026-10-21 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/5b006fd3-fe5d-5175-b5ec-c12c0aee8a15/oracle-mysql-october-2026-cpu-patches-flaws

> Oracle's October 2026 Critical Patch Update fixes numerous MySQL vulnerabilities enabling remote code execution, denial of service, and data exposure; CERT-FR urges patching.

CERT-FR has issued an advisory relaying Oracle's October 2026 Critical Patch Update (cpuoct2026) for the MySQL ecosystem, covering MySQL Server, MySQL Cluster, MySQL Router, MySQL Enterprise Backup, and the various MySQL Connectors (J, Net, ODBC, Python). Affected version ranges span current releases across the 8.0.x, 8.4.x, 9.7.x and 26.7.x branches. The advisory does not describe individual flaw mechanics but groups well over 150 CVEs addressed in this cycle, several of which Oracle rates as allowing remote code execution, remote denial of service, unauthorized data disclosure, data integrity compromise, or security policy bypass.

No exploitation in the wild is mentioned in the advisory, and no proof-of-concept or technical details are provided — this is a standard vendor patch rollup relayed by the French national CERT. Given the breadth of affected components (core server, clustering, backup tooling, client connectors, and the router), organizations running any MySQL deployment should inventory their installed versions against the affected ranges and apply Oracle's October 2026 CPU patches as a priority maintenance action, particularly for internet-facing or multi-tenant database instances where RCE or DoS impact would be most severe.

Defenders should track patch deployment status across all MySQL Enterprise components, not just the server, since Connectors, Enterprise Backup, and Router are also listed as affected. No IOCs, threat actor attribution, or active campaign is associated with this bulletin; it is purely a vulnerability disclosure and remediation advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2025-10148, CVE-2025-10966, CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, CVE-2025-15224, CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2025-9086, CVE-2025-9230, CVE-2025-9232, CVE-2026-101513, CVE-2026-101607, CVE-2026-101608, CVE-2026-101609, CVE-2026-101610, CVE-2026-101611, CVE-2026-101612, CVE-2026-101613, CVE-2026-101614, CVE-2026-101615, CVE-2026-101616, CVE-2026-101617, CVE-2026-101618, CVE-2026-101619, CVE-2026-101620, CVE-2026-101621, CVE-2026-101622, CVE-2026-101623, CVE-2026-101624, CVE-2026-101625, CVE-2026-101626, CVE-2026-101627, CVE-2026-101628

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1351

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5b006fd3-fe5d-5175-b5ec-c12c0aee8a15/oracle-mysql-october-2026-cpu-patches-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup