---
id: "CVE-2026-101808"
kind: "vulnerability"
aliases: ["CVE-2026-101808"]
title: "Oracle E-Business Suite: unauthenticated WebUI flaw exposes and changes data"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle E-Business Suite (Product Workbench WebUI)", "fixed": ["Oct 2026 CPU patch 40022426 (unconfirmed, per Rapid7)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-e-business-suite", "package", "product-workbench", "self-hosted", "vendor"]
not_affected_if: ["default-config", "not-internet-exposed"]
published_at: "2026-10-20T22:18:36+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T23:06:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101808", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:06:08+00:00"}]
---

# Oracle E-Business Suite: unauthenticated WebUI flaw exposes and changes data

Oracle E-Business Suite's Product Workbench WebUI component, versions 12.2.3 through 12.2.15, can be attacked over HTTP without a login. A successful attack lets someone read, create, change or delete the data the workbench can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Product Workbench WebUI) affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU patch 40022426 (unconfirmed, per Rapid7)

## How to check

Check your EBS release: SELECT release_name FROM apps.fnd_product_groups; (12.2.3 to 12.2.15 is affected). Then check whether patch 40022426 (Oct 2026 EBS CPU) is applied: SELECT bug_number FROM ad_bugs WHERE bug_number='40022426'. Also check whether Product Workbench WebUI URLs are reachable from the internet or untrusted networks. Confirm the patch number in the MOS patch availability document.

## Fix

Apply the Oracle October 2026 Critical Patch Update for E-Business Suite (Rapid7 cites patch 40022426:12.2.0; confirm in Oracle's MOS patch availability document). Until patched, do not expose EBS to the internet and restrict access to Product Workbench WebUI.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101808
- 2026-10-23T23:06:08+00:00 analyst — Oracle Oct 2026 CPU (cpuoct2026) lists EBS 12.2.3-12.2.15 as affected. The patch number comes only from Rapid7 (40022426:12.2.0, the EBS Oct-2026 CPU) because I could not open the EBS patch availability document (MOS login). No exploitation or public PoC found. I did not search social posts. NVD page returned empty; the CVE.org record matches the description.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101808 (EBS Oct-2026 CPU, patch 40022426:12.2.0) https://www.rapid7.com/db/vulnerabilities/cve-2026-101808/

## From the sources

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_