Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-101809

Unauthenticated Workflow takeover in Oracle E-Business Suite

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-101809 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

An improper access control flaw in the Workflow Notification Mailer of Oracle E-Business Suite lets an unauthenticated attacker with network access over HTTP compromise Workflow. Successful attacks can take over Workflow and may significantly affect other products. Supported releases 12.2.3 through 12.2.15 are affected.

What to do: Apply Oracle's October security update that addresses CVE-2026-101809. No workaround is stated.

ProductAffected
Oracle E-Business Suite Workflow (Workflow Notification Mailer)12.2.3-12.2.15
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Weakness
CWE-284
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories