{"id":"CVE-2026-101808","kind":"vulnerability","aliases":["CVE-2026-101808"],"related":[],"title":"Oracle E-Business Suite: unauthenticated WebUI flaw exposes and changes data","description":"Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle E-Business Suite's Product Workbench WebUI component, versions 12.2.3 through 12.2.15, can be attacked over HTTP without a login. A successful attack lets someone read, create, change or delete the data the workbench can reach.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Product Workbench WebUI)","fixed":["Oct 2026 CPU patch 40022426 (unconfirmed, per Rapid7)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-e-business-suite","package","product-workbench","self-hosted","vendor"],"not_affected_if":["default-config","not-internet-exposed"],"how_to_check":"Check your EBS release: SELECT release_name FROM apps.fnd_product_groups; (12.2.3 to 12.2.15 is affected). Then check whether patch 40022426 (Oct 2026 EBS CPU) is applied: SELECT bug_number FROM ad_bugs WHERE bug_number='40022426'. Also check whether Product Workbench WebUI URLs are reachable from the internet or untrusted networks. Confirm the patch number in the MOS patch availability document.","fix":"Apply the Oracle October 2026 Critical Patch Update for E-Business Suite (Rapid7 cites patch 40022426:12.2.0; confirm in Oracle's MOS patch availability document). Until patched, do not expose EBS to the internet and restrict access to Product Workbench WebUI.","status":"open","published_at":"2026-10-20T22:18:36+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:36+00:00","updated_at":"2026-10-23T23:06:08+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:38:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle E-Business Suite: unauthenticated WebUI flaw exposes and changes data","impact":"high","summary":"Oracle E-Business Suite's Product Workbench WebUI component, versions 12.2.3 through 12.2.15, can be attacked over HTTP without a login. A successful attack lets someone read, create, change or delete the data the workbench can reach.","category":"vendor","who_cares":["oracle-e-business-suite","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies critical business data without logging in","analyst_note":"Find Oracle's Critical Patch Update advisory and the patched 12.2.x release or patch number for Product Workbench WebUI at https://nvd.nist.gov/vuln/detail/CVE-2026-101808 and Oracle's CPU page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":3122,"output_tokens":386,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and the patched 12.2.x release or patch number for Product Workbench WebUI at https://nvd.nist.gov/vuln/detail/CVE-2026-101808 and Oracle's CPU page.","search":"'-101808':15A,18A '-2026':14A,17A '/av':172C '12.2.15':53B,100C '12.2.3':51B,99C '3.1':160C,171C '9.1':163C 'access':109C,130C,139C,145C,151C,157C 'affect':97C 'allow':104C 'attack':56B,64B,106C,118C 'base':161C 'busi':4A,30B,43B,89C 'business':22A 'chang':11A,69B 'complet':150C 'compon':49B,91C 'compromis':113C 'confidenti':164C 'creat':68B 'creation':126C 'critic':132C,147C 'cve':13A,16A 'cvss':159C,168C,170C 'data':12A,73B,133C,140C,148C,158C 'delet':71B,127C 'e':3A,21A,29B,42B,88C 'e-busi':2A,41B,87C 'e-business':20A 'easili':101C 'exploit':102C 'expos':9A 'flaw':8A 'h/a':179C 'h/i':178C 'host':38B 'http':58B,111C 'impact':167C 'integr':166C 'l/pr':174C 'let':65B 'login':61B 'modif':129C 'n':180C 'n/ac':173C 'n/s':176C 'n/ui':175C 'network':108C 'oracl':1A,28B,40B,81C,86C,114C,136C,154C 'oracle':19A 'oracle-e-business-suit':27B 'packag':32B 'product':24A,34B,46B,82C,84C,115C,137C,155C 'product-workbench':33B 'reach':77B 'read':67B 'result':123C 'score':162C 'self':37B 'self-host':36B 'someon':66B 'success':63B,117C 'suit':5A,31B,44B,90C 'suite':23A 'support':93C 'u/c':177C 'unauthent':6A,105C 'unauthor':125C,144C 'vector':169C 'vendor':39B 'version':50B,94C 'via':110C 'vulner':78C,103C,121C 'webui':7A,26A,48B,92C 'well':142C 'without':59B 'workbench':25A,35B,47B,75B,83C,116C,138C,156C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101808","severity":null,"published_at":"2026-10-20T22:18:36+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101808:368","url":null,"severity":null,"published_at":"2026-10-23T23:06:08+00:00","modified_at":"2026-10-23T23:06:08+00:00","first_seen_at":"2026-10-23T23:06:08+00:00","fetched_at":"2026-10-23T23:06:08+00:00","note":"Oracle Oct 2026 CPU (cpuoct2026) lists EBS 12.2.3-12.2.15 as affected. The patch number comes only from Rapid7 (40022426:12.2.0, the EBS Oct-2026 CPU) because I could not open the EBS patch availability document (MOS login). No exploitation or public PoC found. I did not search social posts. NVD page returned empty; the CVE.org record matches the description."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1781,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101808/","title":"Rapid7: CVE-2026-101808 (EBS Oct-2026 CPU, patch 40022426:12.2.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}