---
id: "CVE-2026-91506"
kind: "vulnerability"
aliases: ["CVE-2026-91506"]
title: "Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer"
severity: "high"
cvss: 8.1
epss: 0.00294
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "other", "workflow"]
not_affected_if: ["unsupported-version-outside-range"]
published_at: "2026-10-20T22:20:55+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91506", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91506", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification Mailer

The Workflow component of Oracle E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Notification Mailer that a remote, unauthenticated attacker can reach over HTTP. Successful exploitation can take over the Workflow component, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release level in the environment and confirm whether it falls in 12.2.3 through 12.2.15, `unknown` for patch-level detail
- Confirm whether the Workflow Notification Mailer is in use, `unknown` for the exact check command

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Workflow, specific patch and target version `unknown` in the sources
- Move to a supported release outside 12.2.3 through 12.2.15, `unknown` for the exact target version

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91506
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91506

## From the sources

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_