Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale.

The company’s flagship Oracle E-Business Suite was home to one of the vulnerabiltiies, tracked as CVE-2026-101809. This enables any unauthenticated attacker with network access via HTTP to compromise the workflow notification mailer in the suite’s Workflow component, taking over Workflow and potentially affecting other products too. The flaw affects Workflow versions 12.2.3 through 12.2.15.

Oracle SOA Suite, part of Oracle Fusion Middleware, was hit by three of the bugs rated 10.0.

One, tracked as CVE-2026-91231, is in the Adapters component, and enables unauthenticated attackers to compromise Oracle SOA Suite resulting in its takeover, with potential impact on connected products.

Two others were in the Fabric Layer component of Oracle SOA Suite: CVE-2026-91216 and CVE-2026-91221.

Both are easily exploitable, Oracle said, and enable an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise Oracle SOA Suite and perhaps affect other products too. The bugs appear in supported versions 12.2.1.4.0 and 14.1.2.0.0.

There’s a 10.0-rated vulnerability in another part of Oracle Fusion Middleware too. The flaw in Oracle Access Manager (tracked as CVE-2026-87337 leaves it open to compromise by any unauthenticated attacker with network access via HTTP. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification of critical data on Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.

The last “perfect 10” vulnerability in Oracle’s latest report is in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards, tracked as CVE-2026-91299. This enables an unauthenticated attacker with network access via HTTP to compromise and take over versions 9.2.0.0 through 9.2.26.5 of the orchestrator.

The US Federal Bureau of Investigation has removed an Accenture contractor working on its PeopleSoft installation over their role in a data breach that exposed personal details of FBI employees, Reuters reported Monday.

This is the first time that anyone other than the hacker group Shinyhunters that claimed responsibility for the breach has linked it to PeopleSoft.

“To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform,” FBI Cyber Division Assistant Director Brett Leatherman told Reuters. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”

Accenture was the third-party organization Leatherman would not identify, “two sources familiar with the matter” told Reuters.

As for the unnamed, unpatched platform, Reuters’ sources said that was Oracle PeopleSoft, the HR system that hacker group ShinyHunters claimed to have exploited in last month’s break-in.

This article first appeared on CSO.

Oracle is adding a new execution layer to its Fusion Cloud Applications Suite that it says will help enterprises lower the costs of automating complex and long-running business processes with AI agents.

The execution runtime, Fusion Claw, uses a combination of a frontier model, deterministic policies, and governed execution capabilities to plan and carry out a given task or process, instead of relying for each step on AI inference, which can result in repeated model calls as the task progresses. That can help enterprises keep inference and compute costs under control, the company said.

The deterministic policies can include approved algorithms, business rules, calculations, optimization services, reconciliation logic, and transaction-processing capabilities. Enterprises can define or configure them via Fusion’s AI Agent Studio while building the agent or modifying existing agentic applications, Oracle said.

Claw then uses two built-in features, the Enterprise Operating Envelope and the Enterprise Trust Harness, to enforce those policies as controls during task execution, ensuring that the agent operates within its delegated authority and the required governance boundaries, while also generating an auditable record of agent actions and decisions, it further said.

Fusion Claw could help improve an agent’s unit economics

For Manoj Chandra Jha, principal analyst at Nord-IQ research, Fusion Claw’s approach to agentic execution is likely to help enterprises with the unit economics of deploying AI agents to automate business processes.

“By keeping the expensive model for planning and running high-volume work on cheap deterministic computation, Fusion Claw can make agentic costs both lower and more predictable for CIOs,” Jha said.

Beyond cost, Fusion Claw’s approach to separating AI reasoning from deterministic execution can also make agentic automation more reliable and repeatable, which could be “critically important” for CIOs trying to move agentic applications from prototype to production, according to Scott Bickley, advisory fellow at Info-Tech Research Group.

The deterministic controls combined with delegated authority, approvals, escalation rules and an auditable record of decisions and transactions can give enterprises a measure of “safe autonomy,” he said.

There are advantages for developers, too, especially in terms of productivity.

As the new execution layer packages up most of the underlying plumbing stack required to operationalize an agentic application, developers can focus on process design, offloading the mundane work of integrating and orchestrating the underlying components needed to put an agentic application into production, Bickley said.

That, in turn, is likely to result in business processes being automated faster, he added.

Lower AI consumption does not necessarily mean lower costs

However, that reduction in development and orchestration work does not eliminate the work required to govern agentic applications, but rather adds to the governance work required, Jha cautioned: “Development teams must encode policies and approval rules, choose autonomy levels, and verify outcomes.”

That outcome verification will also be important for CIOs in determining whether the promised cost savings and cheaper unit economics actually translate into lower costs, rather than simply lower AI consumption, according to Bickley.

While Oracle’s architecture can reduce the amount of AI inference needed for a task, the actual cost of an agentic application can vary based on factors including the actions it performs, token consumption, model used, testing, human review, exception handling and ongoing operational support, Bickley said.

As a result, CIOs should measure the cost of successfully completing a business outcome, such as resolving an accounting exception or filling a staffing gap, rather than looking only at the cost of AI units or tokens, Bickley added.

The analyst also cautioned CIOs about Oracle’s AI unit policy, which he said could introduce additional considerations into the cost of running Fusion Claw-based applications: “Unused pooled units expire without reimbursement, while Oracle can modify its action and model tables with at least 30 days’ notice.”

CIOs should demand per-outcome pricing in writing and let a bounded pilot build the business case, said Jha.

Adoption will depend on process and governance maturity

Those considerations, combined with the added governance requirements, are also likely to shape which enterprises adopt Fusion Claw first, even among existing Oracle customers.

“Existing Oracle Fusion customers with standardized processes, reliable master data, mature controls and high-volume work with measurable outcomes are likely to be the initial adopters. Finance reconciliation, supply-chain planning, staffing and other constraint-heavy processes are logical candidates because they combine analysis with calculations and repeatable execution,” Bickley said.

On the flip side, adoption will be “slower” in enterprises with heavily customized Fusion estates, fragmented data, multiple ERP platforms, weak segregation of duties, or limited AI governance, he added.

For enterprises willing to try out Fusion Claw, the execution runtime is now available as part of the Suite, Oracle said.

The company is also making 25 pre-built Claw-powered agentic applications available, including Ledger, Workforce Staffing, Shipping Consolidation, and Sales Territory Planning, aimed at helping divisional leaders, such as CFOs, CSOs, supply chain heads, and CHROs, improve productivity and reduce costs.

The company will make the other 21 apps available in October, it said.

Oracle’s September 2026 Critical Security Patch Update has arrived with 673 new security patches spanning 17 Oracle product families, with Oracle E-Business Suite accounting for the largest share at 159 patches, followed by Fusion Middleware with 153. Of these, 19 E-Business Suite vulnerabilities and 78 Fusion Middleware vulnerabilities can be remotely exploited without authentication.

Other product categories with 50 or more issues fixed in the rollout include Oracle Database Server, Oracle Communications, and Oracle Analytics.

Oracle recently accelerated its patching rhythm from quarterly to monthly. It advised customers to apply the September patches immediately, warning that it continues to receive reports of successful attacks on its software where customers had not applied available fixes.

Five max-severity flaws sit in Fusion Middleware

The September update addresses five critical vulnerabilities carrying the maximum CVSS score of 10.0 within Fusion Middleware.

They affect Oracle Access Manager (CVE-2026-71133), Oracle Forms (CVE-2026-83099), Oracle Internet Directory (CVE-2026-83059), Oracle Platform Security for Java (CVE-2026-83020), and Oracle WebLogic Server (CVE-2026-83021).

All five are remotely exploitable without authentication over the network; attacking them is of low complexity and requires neither privileges nor user interaction.

The update also addressed a sixth CVSS 10.0 vulnerability, this one in Oracle Hyperion Financial Management (CVE-2026-87230); it too can be remotely exploited without authentication.

The update also includes 13 Fusion Middleware bugs with a CVSS score of 9.9, just below the maximum severity. These include CVE-2026-71163 and CVE-2026-73945 in Oracle Access Manager, CVE-2026-83055, CVE-2026-83057 and CVE-2026-83056 in Oracle Internet Directory, CVE-2026-83058, CVE-2026-73948 and CVE-2026-83039 in Oracle WebCenter Portal, CVE-2026-82999, CVE-2026-82997 and CVE-2026-82998 in Service Delivery Platform, and one each in Oracle WebCenter Sites (CVE-2026-83031) and Oracle WebLogic Server (CVE-2026-83038).

None of these are remotely exploitable without authentication. However, they require low privileges, remain network-accessible and can have high confidentiality and integrity impacts.

Oracle did not mark any of the six CVSS 10.0 and 13 CVSS 9.9 vulnerabilities as exploited in the wild.

Fusion Middleware has featured heavily in Oracle’s recent patch cycles too. Its July update addressed 10 CVSS 10.0 vulnerabilities, highlighting the product family’s recurring exposure to maximum-severity flaws.

Oracle’s patching message is as important as the patches

Until patches can be deployed, Oracle said, customers may reduce exposure by blocking network protocols required for an attack or removing unnecessary privileges and package access. However, it cautioned, these measures can break application functionality and should be tested on non-production systems. They are not to be considered long-term solutions because they do not address the underlying vulnerabilities, the company said in its September critical patch update advisory.

It also included a warning for organizations running older Oracle releases. The fixes are provided only for supported versions, the company said, adding that “Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Security Patch Update.”

Also, for organizations that have skipped earlier security updates, Oracle advises reviewing previous CSPUs and quarterly Critical Patch Updates rather than assuming the September releases covers the backlog.

Oracle began a new round of layoffs this week, sending early-morning termination emails to staff for the second time in six months.

The latest wave began Monday with affected staff being told, “After careful consideration of Oracle’s current business needs, we have made the decision to eliminate your role as part of a broader organizational change,” according to BusinessInsider. Termination was immediate.

That’s the same wording as in the previous wave of layoffs, which took place on March 31 and affected workers in the US, India, Canada, Mexico and Uruguay. In the 12 months to May 31, Oracle cut its global workforce from about 162,000 to about 141,000, a decline of roughly 13%.

Oracle has made no public statement confirming the latest round of job cuts, but in a regulatory filing days earlier the company said it had set aside a further $700 million for restructuring charges, bringing the total charges this year to roughly $2.8 billion.

What the new termination emails say

Staff receiving the latest termination emails were told termination and compensation details would follow by DocuSign, Business Insider wrote. An internal document reviewed by the publication said severance terms varied by role and region, and some teams facing double-digit percentage cuts.

Affected employees took to social media to vent.

Eric Brunson, a senior principal offensive security researcher at Oracle, described in a LinkedIn post how he had lost access to corporate communication tools before receiving any formal notice. “I woke up to not being able to log back into Slack,” he wrote. “No new emails or notification in email and I’m locked out of there. I was able to get ahold of my manager on LinkedIn and she confirmed.” Brunson said the timing fell two days before a scheduled RSU vesting date, adding, “Probably part of the plan.”

The filing that backs up the layoff accounts

While Oracle is not talking about the layoffs, its 10-Q quarterly report states that management approved and supplemented restructuring plans “to implement certain strategic measures and further improve operational efficiencies, including through the adoption and integration of artificial intelligence technologies across certain functions.” It adds that “subsequent to August 31, 2026, our management supplemented the 2026 Restructuring Plan by approximately $700 million to reflect additional actions that we expect to take.”

Oracle has already spent $1.97 billion of the $2.1 billion restructuring charges it originally budgeted, it reported.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the filing should be read carefully rather than as confirmation of a headcount. “The supplement is an estimate, not a bill,” he said, noting it raises the program’s estimated cost by about a third without committing Oracle to a timetable.

Gogia said the more significant shift is in the filing’s language rather than the dollar figure. Oracle’s August 2025 and February 2026 filings had described the plan as tied to “acquisitions and certain other operational activities.”

AI was named as a driver of restructuring for the first time in the Sept. 11 filing.

Why the headcount stays unconfirmed

Gogia said no verified figure exists yet for how many employees the September round affected.

He noted that 30,000 was a January forecast of the total 2026 program. Twenty-one thousand is the confirmed net decline in Oracle’s global workforce across the full fiscal year. A reported 3,000 job cuts in India on Sept. 1 remains unconfirmed by Oracle.

The $700 million restructuring supplement “cannot be divided into people,” Gogia said, since it covers termination benefits, contract termination costs and other exit costs across a program spanning multiple countries. “There is no solid headcount for the September round,” he said.

A pattern that began in March

Oracle’s first 2026 layoff wave began March 31, when the Revenue and Health Sciences unit, the SaaS and Virtual Operations Services group, and NetSuite’s India Development Centre saw some of the deepest reductions.

Figures published by Oracle for its fiscal year ending May 31, 2026, show research and development headcount fell from 50,000 to 43,000 employees during the year, sales and marketing fell from 31,000 to 25,000, and services fell from 37,000 to 34,000, according to Gogia’s analysis of the company’s own reporting.

International staff, at 92,000, saw a larger reduction than the 49,000-strong U.S. workforce, he said.

Oracle did not respond to a request for comment.

Oracle has reportedly garnered some unwanted attention from the European Commission around its enterprise software licensing practices.

The Commission’s antitrust regulators are currently gathering information from third parties about Oracle’s licensing practices to assess whether there is evidence to warrant further action, although it has yet to open a formal investigation into the company, MLex, an independent news outlet specializing in legal risk and regulation, reported.

The Commission, in response to an email inquiry, said that there is currently no formal investigation into any company but stressed that it would continue to monitor possible further anticompetitive practices and abusive conduct in the enterprise software sector.

Oracle did not immediately respond to an email query seeking comments on the issue.

The reported scrutiny into Oracle comes weeks after SAP agreed to binding commitments to address Commission concerns over practices that restricted customers’ ability to switch support providers or terminate certain contracts.

If the EU sees similar practices at Oracle, where licensing or support terms make it costly for enterprises to reduce dependency, switch providers, or change their usage, the regulators could potentially apply the same principle: vendor dominance cannot be used to artificially restrict customer choice in the aftermarket.

In that scenario, the Commission is likely to open an investigation or proceedings under the EU’s Article 102 rules, which prohibit companies with a dominant position in a defined market from engaging in any abusive conduct.

Impact on Oracle products

Several products and their attached licensing practices across Oracle’s portfolio are at risk of drawing more scrutiny from regulators, analysts say.

“Oracle Database is probably the biggest area. Its complex processor, virtualization, and cloud licensing rules can make it difficult for enterprises to know exactly what they owe. Regulators could examine whether these rules make running Oracle on competing clouds or reducing Oracle usage unnecessarily expensive,” said Pareekh Jain, principal analyst at Pareekh Consulting.

Jain pointed out that Java too could attract regulators’ attention as Oracle’s subscription charges are based broadly on an enterprise’s employee strength rather than just Java users.

“For some enterprises, this has sharply increased costs. Regulators could examine whether this pricing approach is reasonable for a technology already deeply embedded in enterprises,” Jain noted.

Similarly, its on-premises ERP portfolio and CRM applications, which include Oracle E-Business Suite, PeopleSoft, JD Edwards EnterpriseOne, Siebel, and Hyperion, could also come under the Commission’s radar, mostly because the licenses of these products resemble practices that could present parallels with the concerns raised in the SAP case.

“Enterprise customers often run these products for decades and want third-party support rather than migration. Rules that make dropping Oracle support, reducing unused licenses or moving only part of the estate to another support provider expensive could attract scrutiny,” Jain said.

The analyst was referring to documentation around Oracle’s Software Technical Support Policies that generally require licenses within a license set to maintain the same level of technical support.

The policies also allow Oracle to reprice support for the remaining licenses when customers reduce their footprint and impose additional costs on reinstating lapsed support.

That policy document also covers a broad range of Oracle products beyond its ERP and CRM portfolio, including its database, middleware and infrastructure software, potentially widening the scope of products and licensing practices that could draw regulatory scrutiny.

A separate Oracle technical support policy for Exadata also contains similar provisions related to support levels, license reductions, and reinstating lapsed support.

What the possible EU scrutiny could mean for CIOs

That prospect of greater scrutiny by the Commission, especially in the wake of the SAP case, could be significant not just for Oracle but also for the enterprises that have built large parts of their IT estates around its software.

For enterprises, the most immediate benefit, according to Manoj Chandra Jha, principal analyst at Nord-IQ Research, would be more negotiating power.

“Expect CIOs and procurement teams to use the mere possibility of a Commission scrutiny to extract concessions in ongoing renewals long before any formal remedy is decided,” Jha said.

“Enterprises could push for greater freedom to drop unused licenses, use third-party support, reduce maintenance costs, or gradually move workloads away from Oracle without being punished financially,” echoed Jain.

That, in turn, could help CIOs reduce Oracle dependency step by step instead of going through a full migration that is bound to be expensive, Jain added.

However, for CIOs and enterprises without ongoing or upcoming Oracle renewals, Jha cautioned against expecting immediate cost relief or contractual flexibility based on the SAP precedent.

“This is likely to be a multi-year outcome, not a Q4 planning assumption,” he said.

A few months ago, I was sitting in a glass-walled conference room with the executive team of a fast-growing enterprise. The vice president of customer operations was enthusiastically demonstrating the new automated agent features their software vendor had just pushed into their CRM platform.

On the screen, the software looked brilliant. The agent could read customer complaints, analyze transaction histories and automatically resolve issues. The VP showed us how the system could independently offer retention incentives to unhappy accounts without a human ever touching a keyboard.

Then I asked a simple question: “What is your approval process when the AI decides to grant a $20,000 contract discount to keep a customer from leaving?”

The room went completely silent. The VP looked at the director of IT, the director of IT looked at the chief risk officer, and everyone realized the same thing at the exact same moment. They had spent three months evaluating software licenses and security protocols, but nobody had asked who gave the software permission to sign off on corporate spending.

Major software providers like Salesforce, SAP and Oracle are rapidly moving beyond simple report writers and conversational chatbots. They are embedding active, autonomous agents directly into the transactional core of systems that manage your revenue, customer agreements and financial ledgers. According to Gartner’s latest adoption forecasts, eighty percent of enterprise applications will deploy these embedded capabilities by 2026. These applications do not just summarize data: they issue refunds, alter contract terms and trigger supply chain orders.

When I review these deployments with client teams, the core problem has nothing to do with artificial intelligence. It is a fundamental breakdown in corporate delegation and signing authority.

The breakdown of the corporate signing matrix

Every mature company I work with operates on a clear delegation of authority matrix. This framework dictates exactly who can sign off on financial commitments. A vice president might have authorization to approve spending up to $500,000, a director might sit at $100,000 and a front-line manager might be capped at $500. For two decades, technology leaders have spent millions of dollars building security and compliance controls to ensure every human employee operates strictly within those limits.

Yet when a software vendor releases an update featuring autonomous agents, companies routinely grant these features unrestricted operational freedom. Because the capability arrives as a native feature inside an existing application, business units enable it with a single click. In my advisory work, I repeatedly see organizations grant third-party software features more financial freedom than their own human managers.

This represents a massive blind spot in executive governance. McKinsey’s global surveys on artificial intelligence reveal a striking pattern across the enterprise landscape: while adoption is accelerating at a historic pace, only a tiny fraction of organizations are actively managing the financial and operational risks of automated decision errors.

The quiet cost of shadow delegation

In my audits, this rarely manifests as a dramatic system crash. It plays out as a quiet margin leak. In one organization I reviewed, a department head had enabled an automated customer retention feature over a weekend. The agent noticed an important account expressing frustration in a support ticket, and to prevent the account from churning, it independently applied an unapproved 15 percent discount to their multi-year contract.

The customer was happy, and the account manager considered the client saved. But from an executive perspective, an unvetted third-party algorithm just executed an unauthorized contract modification that eroded company margins. When the finance team conducted a quarterly audit, they did not discover an employee violating spending policy. They discovered a black-box automated decision that bypassed every internal approval control in the company.

When an auditor tests your internal controls, presenting a log showing that a vendor’s algorithm made an unauthorized financial change does not satisfy the requirement. If an action requires managerial sign-off when performed by a human being, letting software execute it independently is a major control failure.

How I advise executive teams to handle automated authority

Protecting your organization does not mean turning off these tools or falling behind on technology. It means treating vendor-supplied agents exactly like third-party contractors who have not yet passed a background check.

Forrester Research emphasizes that extending zero-trust security frameworks to automated business processes is now mandatory for enterprise risk management. Zero-trust simply means that no user, device or automated tool gets implicit trust. Every proposed action must be validated against explicit business rules before it happens.

When I help enterprise teams design these safeguards, we establish a practical three-tiered boundary for automated tools:

• Read and draft permission: Automated tools can freely analyze trends, draft emails and assemble internal reports. No human sign-off is needed to create a draft, but the system cannot publish or execute anything on its own.
• Standard administrative permission: Tools can handle routine administrative tasks or process standard requests below a strict financial cap (such as a $50 service credit), provided every single action is logged in an audit file that managers review weekly.
• Restricted financial permission: Any action that alters contract terms, changes pricing tiers or issues major refunds are strictly held in an authorization queue. The system generates the request, but a human manager must click “approve” before the change hits the live database.

As a technology executive, you cannot control what automated features software providers bundle into their platforms. You can, however, control the financial boundaries and signing authority those tools are permitted to exercise within your business.

What to do at your next executive leadership meeting

1. Ask for an automated authority inventory: Have your team audit your core software platforms to identify every automated feature currently running with permission to alter financial or customer records.
2. Revert to draft-only mode: Instruct your team to default all vendor-supplied automated agents to “draft only” until a clear business case justifies giving them independent operational authority.
3. Establish a firm human-in-the-loop rule: Require a strict organizational policy that no automated system can modify pricing, contracts or financial ledgers without explicit manager approval.