An easily exploitable, unauthenticated flaw in the WebUI component of Oracle Product Workbench (Oracle E-Business Suite) lets a remote attacker read, create, change or delete critical data. It has a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-101808 is a vulnerability in the WebUI component of Oracle Product Workbench, which is part of Oracle E-Business Suite. Oracle reported it, and NVD published the record on 2026-10-20 with a status of "Received."
According to the vendor description, an unauthenticated attacker with network access over HTTP can exploit the flaw to compromise Oracle Product Workbench. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality / Integrity / Availability: High / High / None
Why It Matters
A successful attack can give the attacker:
- Unauthorized read access: to critical data, or complete access to all data that Oracle Product Workbench can reach.
- Unauthorized write access: the ability to create, delete or modify critical data, or any data Product Workbench can reach.
The attacker needs no credentials and no user interaction, and the attack complexity is low. Any unpatched Product Workbench instance reachable over HTTP is therefore exposed. Availability is not affected, but the high confidentiality and integrity impact puts business data handled through the product at risk.
The supplied CISA KEV entry for this CVE is empty. KEV does not currently confirm active exploitation, and no CISA required action or due date applies. Defenders should still treat the flaw as high priority because it is critical, unauthenticated and network-reachable.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Product Workbench (Oracle E-Business Suite)
- Component: WebUI
- Affected supported versions: 12.2.3 through 12.2.15
The supplied NVD record contains no CPE entries.
Patch Status
The NVD record cites one vendor reference: Oracle's October 2026 Critical Patch Update (CPU) advisory. Organizations running Oracle E-Business Suite 12.2.3–12.2.15 should:
- Read the October 2026 CPU advisory for the fix details for Oracle Product Workbench.
- Apply the relevant patches.
- Until patching is complete, limit network access over HTTP to the Product Workbench WebUI as far as possible.
The supplied data contains no CISA KEV remediation deadline.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101808
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)