Live › vulnerability › CVE-2026-91506
Go to dashboardThe Workflow component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Notification Mailer that a remote, unauthenticated attacker can reach over HTTP. Successful exploitation can take over the Workflow component, with high confidentiality, integrity and availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP are in scope. The sources do not say which configurations expose the mailer, so the exact exposure is unknown.
No product ranges from the sources yet.
unknown for patch-level detailunknown for the exact check commandunknown in the sourcesunknown for the exact target versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.