Oracle and Atlassian release major security patches

Oracle has issued its October Critical Patch Update Advisory, addressing 1,295 security vulnerabilities. Among these, six flaws received the highest possible CVSS rating of 10.0. These critical vulnerabilities affect several flagship products, including Oracle E-Business Suite, Oracle SOA Suite, Oracle Access Manager, and JD Edwards EnterpriseOne Orchestrator. The high-rated flaws allow unauthenticated attackers with network access to potentially compromise or take over various components within these suites.

Separately, Atlassian published its October 2026 security bulletin, covering 75 unique CVEs. The bulletin includes 14 critical-severity and 162 high-severity vulnerabilities, primarily tied to third-party dependencies. Affected products include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. While some flaws involve critical issues in components like Apache Tomcat and Bouncy Castle, Atlassian has assessed the risk to its customers as non-critical and has not reported any active exploitation of these vulnerabilities.