{"id":"CVE-2026-91506","kind":"vulnerability","aliases":["CVE-2026-91506"],"related":[],"title":"Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer","description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"The Workflow component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Notification Mailer that a remote, unauthenticated attacker can reach over HTTP. Successful exploitation can take over the Workflow component, with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.1,"epss":0.00294,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","other","workflow"],"not_affected_if":["unsupported-version-outside-range"],"how_to_check":"- Check the installed Oracle E-Business Suite release level in the environment and confirm whether it falls in 12.2.3 through 12.2.15, `unknown` for patch-level detail\n- Confirm whether the Workflow Notification Mailer is in use, `unknown` for the exact check command","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Workflow, specific patch and target version `unknown` in the sources\n- Move to a supported release outside 12.2.3 through 12.2.15, `unknown` for the exact target version","status":"open","published_at":"2026-10-20T22:20:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:06:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:06:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Workflow, specific patch and target version `unknown` in the sources\n- Move to a supported release outside 12.2.3 through 12.2.15, `unknown` for the exact target version","reach":"internet","title":"Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer","impact":"high","summary":"The Workflow component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Notification Mailer that a remote, unauthenticated attacker can reach over HTTP. Successful exploitation can take over the Workflow component, with high confidentiality, integrity and availability impact.","category":"other","nicknames":[],"who_cares":["oracle-ebs","workflow","erp"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the Workflow component over HTTP","analyst_note":"Find Oracle's advisory and patch number for the Workflow Notification Mailer flaw in the April 2026 CPU to fill in fix and how_to_check; source is https://nvd.nist.gov/vuln/detail/CVE-2026-91506.","how_to_check":"- Check the installed Oracle E-Business Suite release level in the environment and confirm whether it falls in 12.2.3 through 12.2.15, `unknown` for patch-level detail\n- Confirm whether the Workflow Notification Mailer is in use, `unknown` for the exact check command","needs_analyst":true,"not_affected_if":["unsupported-version-outside-range"],"who_is_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP are in scope. The sources do not say which configurations expose the mailer, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":3443,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91506':15A,18A '/av':131C '12.2.15':36B,90C '12.2.3':34B,89C '3.1':118C,130C '8.1':121C 'access':100C 'affect':87C 'allow':95C 'attack':48B,97C,107C 'avail':66B,125C 'base':119C 'busi':4A,32B,77C 'compon':27B,60B,79C 'compromis':104C 'confidenti':63B,122C 'cve':13A,16A 'cvss':117C,127C,129C 'difficult':91C 'e':3A,31B,76C 'e-busi':2A,30B,75C 'eb':22B 'erp':19B 'exploit':54B,93C 'flaw':39B 'h':139C 'h/a':138C 'h/i':137C 'h/pr':133C 'high':62B 'http':52B,102C 'impact':67B,126C 'integr':64B,123C 'mailer':12A,43B,82C 'n/ac':132C 'n/s':135C 'n/ui':134C 'network':8A,99C 'notif':11A,42B,81C 'oracl':1A,21B,29B,74C 'oracle-eb':20B 'product':72C 'reach':50B 'remot':46B 'result':112C 'score':120C 'success':53B,106C 'suit':5A,33B,78C 'support':83C 'take':56B 'takeov':9A,114C 'u/c':136C 'unauthent':7A,47B,96C 'vector':128C 'version':84C 'via':10A,101C 'vulner':68C,94C,110C 'workflow':6A,24B,26B,59B,71C,80C,105C,116C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Workflow product and its Notification Mailer reachable over HTTP are in scope. The sources do not say which configurations expose the mailer, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91506","severity":null,"published_at":"2026-10-20T22:20:55+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91506","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91506","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}