---
id: "CVE-2026-91496"
kind: "vulnerability"
aliases: ["CVE-2026-91496"]
title: "Oracle E-Business Suite: Workflow Notification Mailer flaw allows takeover over HTTP"
severity: "high"
cvss: 7.5
epss: 0.00301
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "package", "self-hosted", "workflow"]
not_affected_if: ["outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:20:54+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91496", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91496", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle E-Business Suite: Workflow Notification Mailer flaw allows takeover over HTTP

Oracle E-Business Suite's Workflow Notification Mailer component has a flaw that a low-privileged user can reach over HTTP. A successful attack can take over the Workflow component, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release level against the affected range `12.2.3` to `12.2.15`
- Confirm whether the Workflow Notification Mailer is in use, as the sources do not say which configurations are exposed

## Fix

- Apply the Oracle Critical Patch Update fix for CVE-2026-91496 on Oracle E-Business Suite 12.2 (the sources do not name the patch number)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91496
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91496

## From the sources

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_