---
id: "CVE-2026-101809"
kind: "vulnerability"
aliases: ["CVE-2026-101809"]
title: "Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite (Workflow Notification Mailer)", "fixed": ["October 2026 CPU (patch 40022426, per Rapid7)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-ebs", "package", "self-hosted", "unauthenticated", "workflow"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:18:36+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T23:06:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101809", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:06:07+00:00"}]
---

# Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer

Oracle E-Business Suite Workflow Notification Mailer, 12.2.3 through 12.2.15, can be taken over by an unauthenticated attacker over HTTP (CVSS 3.1 10.0, scope change). Oracle fixed it in the October 2026 Critical Patch Update, published 2026-10-20. Oracle gives no root cause. It says earlier, unsupported versions are likely affected too. It does not report exploitation, and no public PoC was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Workflow Notification Mailer) affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU (patch 40022426, per Rapid7)

## How to check

Check the EBS release level; anything from 12.2.3 to 12.2.15 is in scope. Then check whether the October 2026 CPU is applied, using Oracle's EBS Release 12 CPU Knowledge Document for Oct 2026 (My Oracle Support note KA923). Rapid7 names patch 40022426 for 12.2.0; confirm it in MOS. Exposure is greatest where EBS HTTP endpoints are reachable from outside. Whether the Mailer must be enabled to be exploitable is not stated: unknown.

## Fix

Apply the Oracle October 2026 Critical Patch Update for EBS 12.2 (Rapid7: patch 40022426, confirm in MOS note KA923). Also apply the Oct 2026 Database and Fusion Middleware fixes that EBS depends on. Until patched, restrict HTTP access to EBS; Oracle says blocking the network protocols an attack needs may reduce risk, but test first.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101809
- 2026-10-23T23:06:07+00:00 analyst — Oracle Oct 2026 CPU (cpuoct2026) lists EBS 12.2.3-12.2.15 and the CVE record confirms the CVSS 10.0 scope. The fix is the Oct 2026 CPU: Rapid7 gives patch 40022426:12.2.0 (secondary source) and ThreatWire gives MOS note KA923. I could not read the MOS note, so the patch number is not confirmed from Oracle. Oracle's pages do not say whether the Notification Mailer must be enabled. I found no KEV listing and no public PoC, and did not search X or social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-101809 https://www.cve.org/CVERecord?id=CVE-2026-101809
- [fix] Rapid7 DB: CVE-2026-101809 https://www.rapid7.com/db/vulnerabilities/cve-2026-101809/
- [mentions] ThreatWire: Oracle EBS Workflow CVE-2026-101809 https://www.threatwire.tech/news/oracle-ebs-workflow-cve-2026-101809-cvss-10-october-2026-cpu

## From the sources

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_