â This Weekâs Focus
A week after the October CPU, the question isnât whether you applied the PeopleSoft patches. Itâs whether you patched everything that sits in front of them.
Oracleâs final advisory went up Tuesday. The PeopleSoft numbers didnât move from the pre-release: 109 patches, 41 remotely exploitable without authentication, a ceiling of 9.8. The total did. It came in at 1,295, not 1,283, and Fusion Middleware grew to 206. The worst scores this quarter arenât in PeopleSoft at all. Theyâre in WebLogic and in the identity tier, the layers that answer before PeopleSoft ever sees a request.
Same day, PeopleTools 8.63 went on-prem, with an MCP server in the box.
Letâs get into it.
đ The Final October Numbers
đ Oracle Critical Patch Update Advisory â October 2026 (Oracle) https://www.oracle.com/security-alerts/cpuoct2026.html
Rev 1, October 20. 1,295 new security patches. PeopleSoft: 109, 41 remotely exploitable without authentication, top score 9.8 (CVE-2026-33466, a third-party Logstash component in PeopleTools, unauthenticated over HTTP). Next is 9.6 in SQR (CVE-2026-101420, low privileges). PeopleTools 8.61â8.63 are in scope, plus Integration Broker, Report Distribution, Business Interlink and PsAdmin rows. Fusion Middleware: 206 patches, 134 unauthenticated. WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 carry two unauthenticated 9.8 Core flaws, one over HTTP (CVE-2026-91323) and one over T3/IIOP (CVE-2026-83399). Java SE: 55, ceiling 7.5. Next releases: November 17 and December 15 (CSPUs), then January 19, 2027 (CPU).
đ October 2026 Oracle Critical Patch Update Analysis (Fortra) https://www.fortra.com/blog/october-2026-oracle-critical-patch-update-analysis
October 21. Fortra counts 1,209 unique CVEs, 519 of them remotely exploitable without authentication and 95 at CVSS 9.0 or higher. Its first âwatchâ item is CVE-2026-87337 in the Oracle Access Manager Authentication Engine, a 10.0, unauthenticated over HTTP, on 12.2.1.4.0 and 14.1.2.1.0.
đ Oracle Releases the October 2026 Critical Patch Update (Waratek) https://waratek.com/news/oracle-releases-the-october-2026-critical-patch-update/
October 21. A vendor with a product to sell, so read past the pitch. The useful lines: Oracle Access Manager also carries a 9.8 over SAML (CVE-2026-87251), and Identity Manager a 9.8 over T3/IIOP. Waratek says it isnât aware of public exploitation of anything newly fixed in this CPU as of publication, and ranks the June PeopleSoft flaw, CVE-2026-35273, as the more urgent PeopleSoft risk. Its advice: restrict T3/IIOP to trusted hosts while you test, but donât confuse that with a patch.
My read: If you sized your window from the pre-release, re-check it against the final advisory. The PeopleSoft rows held, but the middleware rows grew. Then split the work by who actually owns each layer. The Middleware DPK covers Java, WebLogic, Tuxedo and the Oracle Database Client. It doesnât cover your SSO tier. If Oracle Access Manager sits in front of PIA, the 10.0 is a PeopleSoft risk with a different teamâs name on the patch.
𧰠PeopleTools 8.63 Comes On-Prem
đ PeopleTools 8.63 Is Now Available for On-Premises Installation (Oracle / Sasank Vemana) https://blogs.oracle.com/peoplesoft/peopletools-8-63-is-now-available-for-on-premises-installation
October 20, CPU day. On-prem customers can download and install 8.63 starting with 8.63.04. Oracleâs highlights: Application Designer AI Assist, MCP server support âto connect AI-powered tools with PeopleSoft APIs,â Semantic Search with Typo Tolerance, and two new sign-on options, SAML 2.0 and time-based one-time passwords (TOTP). OCI customers have had 8.63 since July.
đ Middleware DPK Enablement Patches Now Available (Oracle / Dan Iverson) https://blogs.oracle.com/peoplesoft/middleware-dpk-enablement-patches-now-available
October 9, for reference. 8.63 includes Middleware DPK support and the Builder, so an 8.63 environment needs neither enablement patch (40124711 or 40124744). Oracle offers two paths: download an Oracle-built Middleware DPK âwhen available,â which Oracle validates first and which is for customers who âcan wait a few days,â or build your own with the Builder, which covers Java, WebLogic, Tuxedo and the Oracle Database Client.
My read: Treat 8.63 as two separate decisions. The upgrade is a PeopleTools project, with a schedule and a regression cycle. Turning on the MCP server and the AI features is an access decision: who can call what and with which rights. Donât let a release date make the second one for you. And if youâre waiting for Oracleâs October Middleware DPK zip, check My Oracle Support for your release before Mondayâs standup. I couldnât find a public Oracle post confirming itâs out.
đ¤ Agents in ERP
This week: PeopleSoftâs MCP server is now something your own team can install.
Until Tuesday, the PeopleTools 8.63 MCP server was an OCI-only conversation. With 8.63.04 on-prem, itâs a change request in your own data center. Oracle describes it as a way to connect AI tools to PeopleSoft APIs. The vendor ships the socket. The rest is yours: which APIs become tools, which identity an agent runs as, whether any tool can write, and where each call gets logged.
The same week, Oracle announced AI Agent Studio for Industry Applications (October 21), with MCP support and âconfigured permissions, policies, and organizational roles.â Oracle says itâs planned âwithin the next 12 months,â and itâs aimed at Oracleâs Industry and Fusion apps, not PeopleSoft.
The question to ask before anyone enables anything: if an agentâs access had to be revoked tonight, who would do it, and how long would it take? Wednesday on LinkedIn: the Agents in ERP post takes that question apart.
đŹ Aaronâs Take
The CPU landed on schedule. This week, the leadership work is closing the gaps between teams.
Re-baseline from the final advisory, not the pre-release. Have your triage owner confirm the PeopleSoft list still matches what you tested, and re-check the middleware rows, which grew.
Find the layers the Middleware DPK doesnât touch. SSO and identity (Oracle Access Manager, Identity Manager), load balancers, web proxies. Each one needs a named owner and an October patch date.
Close the T3/IIOP question. If WebLogic T3 or IIOP is reachable from anywhere it doesnât need to be, restrict it now and record the patch date beside it.
Split the 8.63 plan in two. Put the upgrade on the roadmap. Put the MCP server and AI features in front of security as an access decision, with a default of off until the tool list and write rights are written down.
The patches shipped. Whatâs left this week is making sure every layer they touch has an owner.
Thursdayâs Q&A: Our PeopleSoft sign-on runs through Oracle Access Manager. Is Octoberâs CVSS 10.0 our problem or the identity teamâs? Got a PeopleSoft question of your own? Reply to this email.
đ Join the Community
Subscribe to PeopleSoft Cloud at peoplesoftcloud.com for the Monday Digest and the Thursday Q&A. No vendor spin, just what changed and what to do about it.
â Monday: what moved in the PeopleSoft, Oracle and ERP world, with a read on why it matters â Thursday: one real PeopleSoft question, answered straight â Written by a practitioner who still has to make the change window