Oracle EBS Workflow flaw CVE-2026-101809 scores CVSS 10.0: unauthenticated takeover fixed in October 2026 CPU

What happened

On 20 October 2026, Oracle released its October 2026 Critical Patch Update (CPU). It is the last quarterly CPU of the year.

The top Oracle E-Business Suite (EBS) fix is CVE-2026-101809. It sits in the Workflow product, in the Workflow Notification Mailer component. Oracle scores it CVSS 3.1 10.0, the maximum.

Oracle says an unauthenticated attacker with network access over HTTP can exploit it easily. A successful attack can result in takeover of Workflow.

Scope change

Oracle flags a scope change for this bug. In Oracle's words, attacks on Workflow "may significantly impact additional products".

Who is affected

Oracle lists EBS 12.2.3 to 12.2.15 as the affected supported versions. That is the full EBS range in this update.

Oracle only patches versions under Premier or Extended Support. It does not test older releases. It says earlier versions are likely affected too, and asks customers to upgrade.

The October 2026 CPU in numbers

All figures come from Oracle's advisory and risk matrix:

• 1,295 new security patches across Oracle's product families.
• 194 patches for Oracle E-Business Suite.
• 31 of those EBS flaws may be exploited over a network without credentials.
• 4 EBS flaws score 9.0 or more. CVE-2026-101809 is the only 10.0 in EBS.

The other EBS critical entries are:

• CVE-2026-101767, Oracle Application Object Library (Core), CVSS 9.8, no auth needed.
• CVE-2026-101634, Oracle Mobile Field Service, CVSS 9.1, no auth needed.
• CVE-2026-101808, Oracle Product Workbench (WebUI), CVSS 9.1, no auth needed.

Two more Workflow Notification Mailer bugs are fixed too: CVE-2026-91506 (CVSS 8.1) and CVE-2026-91496 (CVSS 7.5).

Tenable counts 1,209 unique CVEs in the 1,295 patches. It ranks EBS second by patch count, after Fusion Middleware.

Timeline

• 20 October 2026: Oracle publishes the October 2026 CPU and the CVE record.
• 20 October 2026: NVD receives the record. It shows Oracle's 10.0 score.
• 21 October 2026: GitHub adds an unreviewed advisory, GHSA-9vph-6jpf-mwc6.
• 17 November 2026: Oracle's next security release date. Oracle now ships security patches on the third Tuesday of each month.

What is confirmed

• Score. CVSS 3.1 10.0, set by Oracle as the CNA.
• Access. Network, over HTTP. No privileges and no user action needed.
• Impact. Takeover of Workflow, with high impact on confidentiality, integrity and availability.
• Versions. EBS 12.2.3 to 12.2.15.
• Fix. The October 2026 CPU.

What is not confirmed

• Exploitation. Oracle does not report attacks. The CVE is not in the CISA KEV catalog.
• PoC. ThreatWire found no public proof of concept.
• Technical details. Oracle does not publish the root cause or a CWE.
• Code execution. Oracle says "takeover of Workflow". It does not say remote code execution.
• Credit. Oracle's credit statement names no reporter for this CVE.

Why EBS patches matter

Oracle EBS has a record of mass exploitation. In 2025, attackers exploited CVE-2025-61882 as a zero-day, according to Google Threat Intelligence and Mandiant. The campaign was branded CL0P and ended in data theft and extortion emails.

CISA lists four EBS CVEs in KEV, including CVE-2025-61882 and CVE-2025-61884. Oracle's advisory also warns that attackers keep succeeding against customers who skipped available patches.

What to do now

1. Patch EBS. Apply the October 2026 CPU. Use Oracle's EBS Release 12 CPU Knowledge Document for October 2026 (My Oracle Support note KA923).
2. Patch the stack too. Oracle says EBS includes Database and Fusion Middleware parts. Apply their October 2026 fixes as well.
3. Limit HTTP exposure. Until you patch, Oracle says blocking the network protocols an attack needs may reduce risk. Test first; it can break features.
4. Prioritise internet-facing EBS. The 31 no-auth flaws matter most on exposed systems.
5. Plan for monthly patching. Oracle urges customers to move to a monthly security cycle.

Am I affected?

• Do you run Oracle E-Business Suite 12.2? Check your release level.
• Is it 12.2.3 to 12.2.15? Then the Workflow product is in scope.
• Have you applied the October 2026 CPU? If not, treat the system as vulnerable.
• Is EBS reachable from the internet? If yes, patch first. Oracle rates this bug as exploitable without credentials.
• On an older, unsupported release? Oracle did not test it but says it is likely affected. Plan an upgrade.

Related on ThreatWire

See the full record for CVE-2026-101809 and its PoC finder page. Track every Oracle issue on the Oracle vendor tracker. The 2025 zero-day has its own tracker page for CVE-2025-61882. Browse actively exploited CVEs and the CVE tracker.

Sources: Oracle's October 2026 CPU advisory and risk matrices, the Oracle security blog, NVD, CVE.org, GitHub advisory GHSA-9vph-6jpf-mwc6, the CISA KEV catalog, Tenable, Oracle's CVE-2025-61882 alert and Google Threat Intelligence. Links are in the references list.