IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle E-Business Suite: Missing authentication in Product Workbench WebUI

CVE-2026-101808Critical 9.1

← All vulnerabilities

Summary

Oracle E-Business Suite (EBS) Product Workbench, in its WebUI component, is affected by CVE-2026-101808 (CWE-287, CWE-306). Supported versions 12.2.3 through 12.2.15 are affected. An unauthenticated attacker with network access via HTTP can exploit this without user interaction and create, modify or delete data, and gain access to critical data in Product Workbench. The CVSS 3.1 base score is 9.1 (critical), and NVD analysis was still pending at the time of the sources reviewed.

Affected

  • Oracle E-Business Suite, Product Workbench (WebUI component)
  • Versions 12.2.3 through 12.2.15

Fixed in

  • Included in Oracle Critical Patch Update, October 2026 (released 20 October 2026)
  • Exact patch name and number: Unknown. Oracle points EBS customers to My Oracle Support Note KA923; coverage of CVE-2026-101808 still to be confirmed there.
  • Patching the EBS application alone is not sufficient; the related Oracle Database and Fusion Middleware components must also be patched.

Workaround

  • No vendor workaround found: Unknown.
  • Temporary measure only (unverified for this CVE): restrict access to the EBS HTTP interface via firewall, VPN or WAF until patched. Do not rely on a generic WAF rule.

Exploitation

  • Exploited in the wild: no evidence found for this CVE.
  • CISA KEV: not listed as of 21 October 2026 (to be rechecked).
  • Public proof of concept: none found.
  • Note: CVE-2026-101767 (Application Object Library, same CPU) is reported to be probed; this is a different CVE.

Our recommendation

  • Check whether any EBS 12.2.3 to 12.2.15 instance is in use and whether its HTTP interface is reachable from the internet. Internet-reachable instances have the highest priority.
  • Apply the October 2026 CPU, verify the patch in Oracle's advisory and KA923, and patch the EBS application together with its Database and Fusion Middleware components.
  • If patching is not immediately possible, restrict internet exposure of the EBS HTTP interface.
  • Monitor logs for unauthenticated access to Product Workbench and check for KEV listing and vendor updates.
  • Do not confuse this with CVE-2026-61269 (a separate, lower-severity Product Workbench issue).

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:47.

Original description (NVD)

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed