Oracle's October 2026 Critical Patch Update, published October 20, includes 55 new security fixes for Oracle Java SE. Oracle says 49 of them "may be remotely exploitable without authentication." The OpenJDK Vulnerability Group's advisory for the same date lists 53 CVEs fixed in OpenJDK source code, covering the builds most teams actually run from Eclipse Temurin, Amazon Corretto, Azul, Microsoft, Red Hat and Linux distributions. None is critical: the top scores are 7.5 and 7.0. But with 49 network-reachable issues across networking, TLS, XML parsing, Kerberos and the JIT compiler, this is a release to roll out, not to skip.
The useful question is which of the 55 matter for your servers. Oracle's notes answer it, and this post sorts the list by them. All 55 are now in the AgentBeam CVE database.
TL;DR
| Question | Answer |
|---|---|
| Java SE fixes | 55 (Oracle CPU); 53 CVEs in the OpenJDK advisory |
| Remotely exploitable without auth | 49 |
| Severity | 3 high (7.0 to 7.5), 38 medium, 14 low; no critical |
| Oracle versions affected | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2, 27 |
| OpenJDK versions affected | 26.0.2.1, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, 8u504 and earlier |
| Also affected | GraalVM for JDK 17.0.20.1 and 21.0.12.1; GraalVM Enterprise 21.3.19.1.1; JavaFX 21.0.12, 25.0.4, 27 |
| Server-only (Note 3) | 12 CVEs |
| Server and sandboxed client (Note 2) | 31 CVEs |
| Sandboxed client only (Note 1) | 12 CVEs |
| Whole CPU | 1,295 security patches across Oracle products |
The three highest-scoring Java CVEs
| CVE | Score | Component | What Oracle says |
|---|---|---|---|
| CVE-2026-91484 | 7.5 | Java plugin | Local, Java 8 only; applies to sandboxed applets and Web Start running untrusted code |
| CVE-2026-43660 | 7.5 | JavaFX (WebKitGTK) | Remote, needs user interaction; client-side (Note 1); the patch also covers about 55 upstream WebKit CVEs; affects Java 8 with JavaFX and JavaFX 21, 25, 27 |
| CVE-2026-91415 | 7.0 | 2D (client-libs/2d) | Remote, no auth, no interaction, high complexity; exploitable through APIs, such as a web service that renders images or fonts, and in sandboxed clients |
The third one is the most relevant for servers. Java 2D handles image, font and text rendering, and services that generate thumbnails, PDFs, charts or reports from user-supplied data feed it untrusted input. It affects every supported line from 8 to 27, plus GraalVM for JDK 17.
How to read Oracle's notes
Oracle attaches one of three notes to most Java CVEs. They decide whether a bug matters on a server.
| Note | Meaning | Count | Who should care |
|---|---|---|---|
| Note 3 | Exploitable only by supplying data to APIs in the component, for example through a web service | 12 | Server-side Java: APIs, microservices, batch jobs |
| Note 2 | Exploitable through APIs and in sandboxed Web Start or applets running untrusted code | 31 | Both servers and legacy desktop clients |
| Note 1 | Only in clients running untrusted code in the Java sandbox; not in deployments running only trusted code | 12 | Legacy applet and Web Start users, mostly on Java 8 |
Oracle also notes that its scores assume applet users run with administrator privileges; on typical Linux servers the confidentiality, integrity and availability impacts drop from High to Low for the client-side cases.
The server-side list (Note 3)
These 12 apply when your code passes untrusted data into the named component:
| CVE | Score | Component |
|---|---|---|
| CVE-2026-101737 | 5.9 | Compiler (HotSpot JIT), Java 26 only |
| CVE-2026-91462 | 5.9 | JGSS (Kerberos) |
| CVE-2026-87293 | 5.4 | RMI (Java 8) |
| CVE-2026-87291 | 5.3 | Networking (21, 25, 27) |
| CVE-2026-91451 | 5.3 | Networking |
| CVE-2026-91417 | 5.3 | CORBA (Java 8) |
| CVE-2026-91453 | 5.3 | Lightweight HTTP Server (com.sun.net.httpserver) |
| CVE-2026-91452 | 5.3 | Networking |
| CVE-2026-83378 | 4.8 | Compiler (HotSpot JIT), 21, 25, 27 |
| CVE-2026-91487 | 4.8 | Compiler (HotSpot JIT) |
| CVE-2026-87255 | 3.7 | Compiler (HotSpot JIT), 25 and 27 |
| CVE-2026-91461 | 3.7 | JSSE (TLS) |
Add the server-relevant Note 2 items: the SOCKS5 networking flaw at 6.8 with a changed scope (CVE-2026-91398), Kerberos/JGSS (CVE-2026-91411), Security and JAAS libraries, JAXP XML parsing (CVE-2026-87290, CVE-2026-83400, CVE-2026-87367), JDBC (CVE-2026-83387), java.util.jar (CVE-2026-91395, CVE-2026-91396) and TLS (CVE-2026-91373, CVE-2026-83376).
Four JIT compiler bugs stand out because they need no specific API: code that runs on HotSpot can be affected. One, CVE-2026-83378, was credited to Bruce Dang of Calif.io, the same research firm behind part of this week's PHP2Shell work.
How to update
- Find every Java runtime. Application servers, microservices, build agents, CI images, Kafka, Elasticsearch, Jenkins, IDEs and anything bundling a JRE.
java -version
find / -name 'release' -path '*j*' -exec grep -H JAVA_VERSION {} \; 2>/dev/null
docker images --format '{{.Repository}}:{{.Tag}}' | grep -Ei 'jdk|jre|temurin|corretto|openjdk|java'
- Install the October 2026 update for each line from your vendor. Oracle customers use the CPU patches; OpenJDK users take the matching update from Temurin, Corretto, Zulu, Microsoft Build of OpenJDK, Red Hat or their distribution as it ships.
- Rebuild container images with
--pullfrom the updated base tags. - Restart every Java process. A running JVM keeps the old classes and JIT.
- Check GraalVM and JavaFX separately; they are listed products with their own versions.
- Move off Java 8 applets and Web Start if you still run them: 12 of these fixes exist only for that sandbox model.
Oracle points Java SE subscribers to Java Management Service to find vulnerable runtimes across a fleet.
Why this matters for teams running agents
Java is everywhere agent backends reach: data platforms, search clusters, message queues, internal APIs. Agents that call those systems with user-supplied input are exactly the "supplying data to APIs" path Oracle describes. Patching the runtime closes the bug; keeping agent inputs validated and agent credentials scoped limits the blast radius of the next one. When coding agents update dependencies or Dockerfiles for you, review that the base image tag actually moved; Beam records the commands those agents run, which helps confirm what changed.
Related reading
- GitLab CVE-2026-110264: CVSS 10 regex RCE
- Node.js October 2026 security release for agent tools
- PHP2Shell patch guide
- Oracle CVEs in the AgentBeam database
Primary sources: Oracle Critical Patch Update, October 2026: Java SE risk matrix · OpenJDK Vulnerability Advisory 2026/10/20
Accurate as of October 22, 2026. Oracle publishes no technical details for Java CVEs beyond the risk matrix; check your vendor for exact fixed build numbers.