Oracle Critical Patch Update, October 2025 Security Update Review | Qualys

Summary: Oracle's October 2025 Critical Patch Update addressed 374 security vulnerabilities across its product families, with Oracle Communications receiving the most patches at 73, followed by Oracle Communications Applications at 64 and Oracle Financial Services Applications at 33. Of the 374 patches, 298 (about 80%) are for non-Oracle CVEs such as open-source components included in Oracle product distributions, and the update includes 18 patches for Oracle Database products.
Why it matters: In Oracle Communications alone, 47 of the 73 patched vulnerabilities can be exploited over a network without user credentials, and CVE-2025-6965 carries a CVSS score of 9.8 - a remote, low-complexity attack path that does not require privileges.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-45853 CVE-2024-37371 CVE-2025-4517 CVE-2025-49796 CVE-2025-53037 CVE-2025-61757 CVE-2025-6965
Related: CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Nov 21, 2025
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026