Oracle's October security patches: what to fix first in EBS, PeopleSoft and Access Manager

Oracle published its October Critical Patch UpdatedefinitionOracle's quarterly patch bundle for on-premises products, mostly cumulative. It comes out on the third Tuesday of January, April, July and October. on Tuesday, and only July's CPU was bigger this year. Six of the flaws score a perfect 10.0, and two of those sit in products that users and partners reach every day: the E-Business Suite Workflow Notification Mailer and Oracle Access Manager. If you run EBS, PeopleSoft or Oracle's identity stack, this one goes to the front of the change calendar.

If someone gets in through one of these holes, they're inside the system that holds your suppliers, invoices, payroll and approvals. They could read that data, change it or take the system down at month end. Access Manager is worse in a way, because it's the front door for every app behind it, so a hole there puts all of those apps at risk at once.

Oracle's October advisory doesn't say any of these new flaws is being exploited yet. History says don't wait for that. Earlier EBS and PeopleTools bugs were used by attackers, some of them by ransomware gangs, and Oracle had to ship emergency fixes outside the normal schedule.

The exploited-list entries are why we don't treat Oracle patching as routine. CISA's catalog has nine Oracle entries added since the start of 2025, four of them for EBS or PeopleTools, and three carry its ransomware flag. The October 2025 EBS alert had a nasty detail too: Oracle required the October 2023 CPU as a prerequisite. Sites that hadn't applied the October 2023 CPU couldn't apply the emergency fix until they'd caught up.

Here's who has real work from this release. If you're a business owner, forward this list to whoever runs your Oracle systems and ask which lines apply to you.

• EBS DBAs and apps admins: the two no-login EBS flaws in Workflow and Application Object Library, plus 192 other EBS patches across 12.2.3 to 12.2.15.
• Identity teams on OAM and OIM: eight Access Manager CVEs across nine matrix rows, all reachable without credentials, and a support deadline in December for 12.2.x.
• WebLogic and SOA platform owners: two 9.8s in WebLogic core and three 10.0s in SOA Suite, which matter to every app hosted on those servers.
• PeopleSoft admins on PeopleTools 8.61 to 8.63: 109 patches, after a PeopleTools flaw in June that CISA lists as used in ransomware.
• Utilities teams on CC&B, C2M and NMS: eight patches, mostly bundled libraries, on Framework and NMS versions up to the 26.x and 25.12 lines.
• Security and audit: a documented reason for each fix you defer, which matters more now that there's a release every month.
• Java owners: the October 21 Security Alert changes which CA certificates Java trusts, so test anything that talks TLS to services using eMudhra intermediates.

The EBS pair is the one we'd move first. The Workflow Notification Mailer is what sends approval notifications out by email and reads the replies, and Application Object Library is under every module. Neither flaw needs a password. Oracle's advisory doesn't say either is being exploited, but EBS has a history here, and the next chapter covers it.

Most of the 1,295 patches are low or medium risk, or bugs in bundled open-source libraries that only matter in some configurations. Don't read the advisory top to bottom. Start with the rows marked "remote exploit without authentication: Yes" on a protocol your network actually exposes, then work down.

Access Manager is the quiet one. Where OAM is deployed, it usually sits in front of EBS, PeopleSoft and custom apps as the single sign-on layer, so a flaw in its authentication engine is a flaw in the front door for everything behind it. Nine OAM rows in the matrix this quarter, all reachable without credentials, and the SAML one matters to anyone federating with a partner or a cloud IdP. Patch OAM in the same window as the apps it protects, or the apps behind it are still exposed through the front door.

One detail in the advisory trips people up every quarter. When a row says HTTP, Oracle means HTTP and every secure variant of it, so HTTPS is affected too. A TLS-only endpoint isn't safe just because the matrix says HTTP. HTTPS only gets its own line when it's the only variant affected.

PeopleSoft's top score comes from Logstash, a third-party log shipper that PeopleTools bundles. That's common in this CPU. Roughly one entry in six names a bundled open-source component, such as Logstash, Apache Mina, Netty or OpenSSL, and when Oracle decides one isn't exploitable in its product, it lists it under the risk matrix with a VEX justificationdefinitionA note Oracle adds under the risk matrix when a bundled third-party CVE can't be exploited in its product. Keep it handy for the next scanner finding.. Read those notes before you tell a scanner vendor the finding is a false positive.

Some things the patches won't fix. Oracle only ships patches for versions still in Premier or Extended Support, so an old EBS level or a 12.2.x identity server past its support date gets nothing. Oracle's suggested workarounds, blocking protocols or pulling privileges, cut the risk but can break features, and Oracle says not to treat them as a long-term answer. If you can't patch, those workarounds only buy you time.

$ $ORACLE_HOME/OPatch/opatch lspatches
# lists each patch in this Oracle home
# one line per patch: number;description
$ java -version
# compare with the Oct 21 Java alert

Patching this release closes these holes. The next ones come in four weeks, because Oracle now ships security fixes every month. What hurts less next time is a patch process sized for that pace, Oracle apps that strangers can't reach directly, and versions that are still in support.

Oracle added a second patch stream this year. Critical Security Patch Updates, or CSPUs, started on May 28 and now ship on the third Tuesday of the eight months without a CPU. Oracle describes them as targeted, high-priority fixes in a smaller format. In practice, as the table shows, some of them aren't small at all.

Add it up and EBS alone has taken 976 new patches since January, most of them since June. A team that planned two EBS patch windows a year now has eight releases to look at. You won't apply all of them. You will have to read all of them, decide, and write the decision down for your auditors.

The bigger catch is in Oracle's FAQ. Where Oracle can, it makes CPUs cumulative, so the newest CPU includes the fixes from earlier releases and Security Alerts. CSPUs don't work that way. Skip one and its fixes stay missing until the next CPU, unless you apply them separately. Some products never get cumulative patches, only one-offs, and for those you have to go back through every earlier advisory to see what you've missed.

An analyst quoted by CSO after the July release said enterprise uptake of the monthly rhythm is still low, and put it down to certification work, regression risk and a shortage of specialist hours. That matches the numbers. A quarterly regression pack wasn't sized for this volume.

With a release every month, you need two lanes. A fast lane for the handful of fixes that face the internet and need no login, and the regular quarterly lane for everything else, tested properly. If you already run a quarterly cycle, the fast lane is the part to add.

Now the deadline. Oracle's Lifetime Support Policy for Fusion Middleware ends Premier Support for the 12.2.x releases of Access Management, Identity Governance, Unified Directory and Internet Directory in December 2026, and for WebLogic Server 12.2.x too. Extended Support runs to December 2027, and Oracle sells it for an additional fee. The October CPU lists OAM and OIM 12.2.1.4.0 among the affected versions. CPU patches only go to versions in Premier or Extended Support, so the January CPU is the first one where your contract, and not just your test plan, decides whether you get a fix.

EBS has a carve-out worth knowing. The applications policy says Fusion Middleware inside the EBS 12.2 internal technology stack stays supported for as long as EBS 12.2 is, and EBS 12.2 has Premier Support through at least December 2037. That covers the middleware EBS ships with. A separate OAM 12.2 server fronting EBS for single sign-on is its own product with its own dates, so check it on the middleware table.

We support EBS 12.2 and PeopleSoft estates and upgrade Oracle Access Management and Identity Governance, so we can take on the inventory, the triage and the regression testing, or the move from 12.2.x to 14c before December. See our Oracle EBS and Fusion ERP page, our PeopleSoft page and our Oracle identity page. If you need engineers for a patch window, see who we can staff. To find out first where your Oracle estate is exposed, start with an assessment.