Live › vulnerability › CVE-2026-91496
Go to dashboardOracle E-Business Suite's Workflow Notification Mailer component has a flaw that a low-privileged user can reach over HTTP. A successful attack can take over the Workflow component, with high impact to confidentiality, integrity and availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP. An attacker needs a low-privileged account; the sources do not say whether non-default setup is required, so teams outside that release range can likely skip it.
No product ranges from the sources yet.
12.2.3 to 12.2.15Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91496")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.