Live › vulnerability › CVE-2026-101809
Go to dashboardOracle E-Business Suite Workflow Notification Mailer, 12.2.3 through 12.2.15, can be taken over by an unauthenticated attacker over HTTP (CVSS 3.1 10.0, scope change). Oracle fixed it in the October 2026 Critical Patch Update, published 2026-10-20. Oracle gives no root cause. It says earlier, unsupported versions are likely affected too. It does not report exploitation, and no public PoC was found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Oracle E-Business Suite (Workflow Notification Mailer) | vendor | >= 12.2.3, <= 12.2.15 | October 2026 CPU (patch 40022426, per Rapid7) |
12.2.3 to 12.2.15 is in scope12.2.0; confirm it in MOSEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101809")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.