CVE-2026-101809
Oracle E-Business Suite Workflow Notification Mailer unauthenticated takeover
Oracle's October 2026 Critical Patch Update fixes CVE-2026-101809 in the Workflow product of Oracle E-Business Suite (Workflow Notification Mailer). An unauthenticated attacker with HTTP access can take over Workflow, with scope change. Versions 12.2.3 to 12.2.15. Oracle scores it CVSS 3.1 10.0. Not in CISA KEV.
By ThreatWire Desk · Published 20 Oct 2026 · Updated 21 Oct 2026
- CVSS
- 10
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Class
- Other
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Oracle
- Products
- Oracle E-Business Suite, Oracle Workflow
- Affected
- Oracle E-Business Suite 12.2.3 to 12.2.15 (supported versions listed by Oracle). Component: Workflow Notification Mailer of the Workflow product.
- Fixed
- October 2026 Critical Patch Update (20 October 2026). Oracle points EBS customers to the Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (October 2026), My Oracle Support note KA923.
- CWE
- Not recorded
- Published
- 20 Oct 2026
- Updated
- 21 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-101809 is a flaw in the Workflow product of Oracle E-Business Suite (EBS). The vulnerable component is the Workflow Notification Mailer. Oracle fixed it in the October 2026 Critical Patch Update, released on 20 October 2026.
Oracle says the bug is easy to exploit. An unauthenticated attacker with network access over HTTP can compromise Workflow. A successful attack can result in takeover of Workflow. Oracle notes a scope change: attacks may significantly impact other products.
Oracle scores it CVSS 3.1 10.0, the maximum. The full vector is in the CVSS field. It is the only 10.0 among the 194 EBS fixes in this update.
Affected supported versions are EBS 12.2.3 to 12.2.15. Oracle does not publish a CWE for it, and its credit statement names no reporter for this CVE.
The fix ships in the October 2026 CPU. For which patches to apply, Oracle points to its EBS Release 12 CPU Knowledge Document for October 2026 (My Oracle Support note KA923). Oracle also asks EBS customers to patch the Oracle Database and Fusion Middleware parts of EBS. Oracle does not test unsupported releases but says they are likely affected.
The CVE is not in the CISA KEV catalog. Oracle does not report exploitation. ThreatWire found no public PoC. GitHub advisory GHSA-9vph-6jpf-mwc6 is unreviewed and repeats Oracle's data.
Oracle EBS has been hit hard before. CVE-2025-61882 was exploited as a zero-day in a CL0P-branded extortion campaign in 2025, according to Google Threat Intelligence. Read the full explainer.