{"id":"CVE-2026-101809","kind":"vulnerability","aliases":["CVE-2026-101809"],"related":[],"title":"Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer","description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle E-Business Suite Workflow Notification Mailer, 12.2.3 through 12.2.15, can be taken over by an unauthenticated attacker over HTTP (CVSS 3.1 10.0, scope change). Oracle fixed it in the October 2026 Critical Patch Update, published 2026-10-20. Oracle gives no root cause. It says earlier, unsupported versions are likely affected too. It does not report exploitation, and no public PoC was found.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Workflow Notification Mailer)","fixed":["October 2026 CPU (patch 40022426, per Rapid7)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-ebs","package","self-hosted","unauthenticated","workflow"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the EBS release level; anything from 12.2.3 to 12.2.15 is in scope. Then check whether the October 2026 CPU is applied, using Oracle's EBS Release 12 CPU Knowledge Document for Oct 2026 (My Oracle Support note KA923). Rapid7 names patch 40022426 for 12.2.0; confirm it in MOS. Exposure is greatest where EBS HTTP endpoints are reachable from outside. Whether the Mailer must be enabled to be exploitable is not stated: unknown.","fix":"Apply the Oracle October 2026 Critical Patch Update for EBS 12.2 (Rapid7: patch 40022426, confirm in MOS note KA923). Also apply the Oct 2026 Database and Fusion Middleware fixes that EBS depends on. Until patched, restrict HTTP access to EBS; Oracle says blocking the network protocols an attack needs may reduce risk, but test first.","status":"open","published_at":"2026-10-20T22:18:36+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:36+00:00","updated_at":"2026-10-23T23:06:07+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:38:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for Workflow, or upgrade to a release outside 12.2.3-12.2.15: unknown for the exact patch number.","reach":"internet","title":"Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer","impact":"high","summary":"Oracle E-Business Suite Workflow Notification Mailer, versions 12.2.3 through 12.2.15, can be compromised over HTTP by an unauthenticated attacker. Successful attacks take over Workflow and can spill over into other products on the same suite.","category":"package","who_cares":["oracle-ebs","workflow","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over Workflow and can reach other suite products.","analyst_note":"Find Oracle's CPU advisory and the exact patch number for Workflow Notification Mailer 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-101809.","how_to_check":"Check the installed Oracle E-Business Suite release and Workflow patch level against Oracle's advisory: unknown for exact commands.","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000551,"input_tokens":3087,"output_tokens":484,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and patch list for EBS 12.2.3-12.2.15 workflow notification mailer, and confirm the fix version and whether the mailer must be enabled.","search":"'-10':74B '-101809':15A,18A '-20':75B '-2026':14A,17A '/av':177C '10.0':59B,167C '12.2.15':46B,123C '12.2.3':44B,122C '2026':68B,73B '3.1':58B,164C,176C 'access':132C 'addit':148C 'affect':88B,120C 'allow':127C 'attack':54B,129C,144C,153C 'avail':171C 'base':165C 'busi':4A,39B,110C 'business':22A 'c/c':182C 'caus':80B 'chang':61B,151C 'compon':112C 'compromis':136C 'confidenti':168C 'critic':69B 'cve':13A,16A 'cvss':57B,163C,173C,175C 'e':3A,21A,38B,109C 'e-busi':2A,37B,108C 'e-business':20A 'earlier':83B 'easili':124C 'eb':29B 'exploit':94B,125C 'fix':63B 'found':100B 'give':77B 'h':185C 'h/a':184C 'h/i':183C 'host':33B 'http':56B,134C 'impact':147C,172C 'integr':169C 'l/pr':179C 'like':87B 'mailer':12A,26A,43B,115C 'may':145C 'n/ac':178C 'n/s':181C 'n/ui':180C 'network':8A,131C 'notif':11A,42B,114C 'notification':25A 'octob':67B 'oracl':1A,28B,36B,62B,76B,107C 'oracle':19A 'oracle-eb':27B 'packag':30B 'patch':70B 'poc':98B 'product':105C,149C 'public':97B 'publish':72B 'report':93B 'result':158C 'root':79B 'say':82B 'scope':60B,150C 'score':166C 'self':32B 'self-host':31B 'signific':146C 'success':152C 'suit':5A,40B,111C 'suite':23A 'support':116C 'taken':49B 'takeov':9A,160C 'unauthent':7A,34B,53B,128C 'unsupport':84B 'updat':71B 'vector':174C 'version':85B,117C 'via':10A,133C 'vulner':101C,126C,140C,156C 'workflow':6A,24A,35B,41B,104C,113C,137C,143C,162C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101809","severity":null,"published_at":"2026-10-20T22:18:36+00:00","modified_at":"2026-10-22T19:17:35+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101809:367","url":null,"severity":null,"published_at":"2026-10-23T23:06:07+00:00","modified_at":"2026-10-23T23:06:07+00:00","first_seen_at":"2026-10-23T23:06:07+00:00","fetched_at":"2026-10-23T23:06:07+00:00","note":"Oracle Oct 2026 CPU (cpuoct2026) lists EBS 12.2.3-12.2.15 and the CVE record confirms the CVSS 10.0 scope. The fix is the Oct 2026 CPU: Rapid7 gives patch 40022426:12.2.0 (secondary source) and ThreatWire gives MOS note KA923. I could not read the MOS note, so the patch number is not confirmed from Oracle. Oracle's pages do not say whether the Notification Mailer must be enabled. I found no KEV listing and no public PoC, and did not search X or social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1777,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101809/","title":"Rapid7 DB: CVE-2026-101809","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1778,"url":"https://www.threatwire.tech/news/oracle-ebs-workflow-cve-2026-101809-cvss-10-october-2026-cpu","title":"ThreatWire: Oracle EBS Workflow CVE-2026-101809","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1780,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101809","title":"CVE Record: CVE-2026-101809","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}