Oracle’s October MySQL Patches: Review Group Replication, JSON and Upgrade Branches

A new patch cycle for business data systems

Oracle published its October 2026 Critical Patch Update on October 20. It includes 98 new patches across the MySQL product family; Oracle classifies 29 vulnerabilities in that family as remotely exploitable without authentication. This does not mean every MySQL deployment has the same 29 attack paths.

MySQL 8.4.13 release notes were also published that day. Teams running ERP, commerce or internal applications should inventory actual branches and components before scheduling upgrades. The overall Oracle CPU count of 1,295 security patches is neither a unique-CVE count nor a MySQL-only figure.

Two examples show why prerequisites matter

CVE-2026-101781 concerns Server: Group Replication GCS and scores CVSS 3.1 8.8. Oracle marks authentication as unnecessary but the attack vector as adjacent network. Listed MySQL Server versions are 8.4.0–8.4.12, 9.7.0–9.7.3 and 26.7.0–26.7.1, with corresponding Cluster entries.

CVE-2026-101785 concerns Server: JSON, scores 8.3 and requires low privileges over the network. The matrix records high integrity and availability impact when prerequisites are met. It should not be presented as an unconditional unauthenticated Internet attack.

Other rows cover build dependencies, client programs, connectors and backup software. Read the exact component and protocol rather than applying one component’s 9.8 score to everything. Exploitability classifications do not themselves establish exploitation in the wild.

Match remediation to the branch and deployment model

For the 8.4 branch, consult the October 20 MySQL 8.4.13 notes alongside the advisory and distribution package. For other branches, use their actual patch-availability and release documentation rather than guessing a version by incrementing a number. Managed database users need their service provider’s maintenance guidance.

Friday Works recommends reviewing primary servers, replicas, Group Replication members and relevant client or backup tools. A dashboard showing one updated primary does not prove that the remaining nodes or application connectors are remediated.

Validate recovery and representative business operations

Before changing production, confirm a restorable backup and test the update in a representative environment. Afterwards verify the running version, replication health, connection errors and business queries. Include legitimate JSON-dependent tasks where relevant; vulnerability exploitation is not required for acceptance testing.

If immediate patching is impossible, limit database reachability to necessary application and administrative systems, review account privileges and agree a remediation window. These exposure-reduction recommendations do not replace the patch or guarantee protection against every CPU issue.

The cover is DnaX’s November 16, 2020 MySQL Workbench 8 Administration Server Status screenshot, GPL 2.0 or later. Its sample server is 5.7.19, not 8.4.13. Labels are unchanged and it is not evidence of a completed October 2026 upgrade.