{"id":"CVE-2026-91496","kind":"vulnerability","aliases":["CVE-2026-91496"],"related":[],"title":"Oracle E-Business Suite: Workflow Notification Mailer flaw allows takeover over HTTP","description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Workflow Notification Mailer component has a flaw that a low-privileged user can reach over HTTP. A successful attack can take over the Workflow component, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.5,"epss":0.00301,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","package","self-hosted","workflow"],"not_affected_if":["outside-12.2.3-12.2.15"],"how_to_check":"- Check the installed Oracle E-Business Suite release level against the affected range `12.2.3` to `12.2.15`\n- Confirm whether the Workflow Notification Mailer is in use, as the sources do not say which configurations are exposed","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91496 on Oracle E-Business Suite 12.2 (the sources do not name the patch number)","status":"open","published_at":"2026-10-20T22:20:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:18:17+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:17Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91496 on Oracle E-Business Suite 12.2 (the sources do not name the patch number)","reach":"internet","title":"Oracle E-Business Suite: Workflow Notification Mailer flaw allows takeover over HTTP","impact":"high","summary":"Oracle E-Business Suite's Workflow Notification Mailer component has a flaw that a low-privileged user can reach over HTTP. A successful attack can take over the Workflow component, with high impact to confidentiality, integrity and availability.","category":"package","nicknames":[],"who_cares":["oracle-ebs","workflow","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Workflow component, reading and changing its data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91496 to confirm the patch number and whether the Notification Mailer needs non-default setup; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-91496 does not give these.","how_to_check":"- Check the installed Oracle E-Business Suite release level against the affected range `12.2.3` to `12.2.15`\n- Confirm whether the Workflow Notification Mailer is in use, as the sources do not say which configurations are exposed","needs_analyst":true,"not_affected_if":["outside-12.2.3-12.2.15"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP. An attacker needs a low-privileged account; the sources do not say whether non-default setup is required, so teams outside that release range can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":3441,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91496':16A,19A '/av':133C '12.2.15':91C '12.2.3':90C '3.1':120C,132C '7.5':123C 'access':102C 'affect':88C 'allow':10A,96C 'attack':54B,99C,109C 'avail':68B,127C 'base':121C 'busi':4A,32B,78C 'compon':38B,60B,80C 'compromis':106C 'confidenti':65B,124C 'cve':14A,17A 'cvss':119C,129C,131C 'difficult':92C 'e':3A,31B,77C 'e-busi':2A,30B,76C 'eb':23B 'erp':20B 'exploit':94C 'flaw':9A,41B 'h':141C 'h/a':140C 'h/i':139C 'h/pr':135C 'high':62B 'host':27B 'http':13A,51B,104C 'impact':63B,128C 'integr':66B,125C 'l/ui':136C 'low':45B,97C 'low-privileg':44B 'mailer':8A,37B,83C 'n/ac':134C 'n/s':137C 'network':101C 'notif':7A,36B,82C 'oracl':1A,22B,29B,75C 'oracle-eb':21B 'packag':24B 'privileg':46B,98C 'product':73C 'reach':49B 'result':114C 'score':122C 'self':26B 'self-host':25B 'success':53B,108C 'suit':5A,33B,79C 'support':84C 'take':56B 'takeov':11A,116C 'u/c':138C 'user':47B 'vector':130C 'version':85C 'via':103C 'vulner':69C,95C,112C 'workflow':6A,28B,35B,59B,72C,81C,107C,118C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP. An attacker needs a low-privileged account; the sources do not say whether non-default setup is required, so teams outside that release range can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91496","severity":null,"published_at":"2026-10-20T22:20:54+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91496","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91496","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}