Recommended action window: Monitor and triage in normal cycle
NVD description
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 Oracle EBS CVE-2026-101809 (CVSS 10.0): unauthenticated HTTP flaw in the Workflow Notification Mailer can lead to Workflow takeover. EBS 12.2.3–12.2.15. Fixed in the Oct 2026 CPU (194 EBS fixes, 31 no-auth). Not in KEV. Patch now. https://www.threatwire.tech/news/oracle-ebs-workflow-cve-2026-101809-cvss-10-october-2026-cpu #Oracle #Infosec #CyberSecurity
A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow. Oracle fixed 194 EBS flaws. #Oracle #EBusinessSuite #CVE2026101809 #CVE2026101767 #PatchNow https://securityonline.info/oracle-e-business-suite-vulnerability-cve-2026-101809/
Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs, including six CVSS 10.0 bugs such as CVE-2026-101809 in E-Business Suite. #Oracle #CriticalPatchUpdate #CVE2026101809 #WebLogic #PatchNow https://securityonline.info/oracle-critical-patch-update-october-2026/