An easily exploitable flaw in the Workflow Notification Mailer of Oracle E-Business Suite 12.2.3 through 12.2.15 lets an unauthenticated attacker with network access take over Workflow over HTTP. It is rated CVSS 10.0.
What Is It
CVE-2026-101809 is a vulnerability in the Workflow product of Oracle E-Business Suite, in the Workflow Notification Mailer component. Oracle ([email protected]) reported it, and NVD published it on 2026-10-20. Its NVD status is currently "Received."
According to the vendor description, an unauthenticated attacker with network access via HTTP can exploit the flaw easily and compromise Workflow. A successful attack can result in takeover of Workflow.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives the highest possible base score of 10.0 (CRITICAL). In practice, that means:
- Network-reachable: it can be exploited remotely over HTTP.
- Low complexity: the attack needs no special conditions.
- No privileges or user interaction: no credentials and no victim action are required.
- Scope change: the flaw is in Workflow, but Oracle notes that attacks may significantly impact additional products.
- High impact on all three areas: confidentiality, integrity and availability.
E-Business Suite often handles core finance, HR and supply-chain processes. An unauthenticated, full-impact flaw in a component reachable over HTTP is a high priority for any organization running affected versions.
Exploitation status: CVE-2026-101809 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation and no CISA-mandated remediation deadline.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle E-Business Suite, Workflow
- Component: Workflow Notification Mailer
- Affected versions: 12.2.3 through 12.2.15 (supported versions)
NVD has not yet published CPE configuration data for this record.
Patch Status
NVD's only reference for this CVE is Oracle's Critical Patch Update advisory for October 2026. Administrators of E-Business Suite 12.2.3–12.2.15 should review that advisory and apply the relevant fixes for the Workflow product.
Because the attack needs no authentication, organizations should also check whether their E-Business Suite Workflow components can be reached over HTTP from untrusted networks while they plan patching. CISA has issued no required action, since the CVE is not in KEV.