Oracle E-Business Suite Workflow: Remote compromise in Notification Mailer
Summary
The Workflow Notification Mailer component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 contains a vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Workflow. Because the vulnerability has a scope change, attacks can also significantly affect additional products. The CVSS 3.1 base score is 10.0 (critical), with high impact on confidentiality, integrity and availability.
Affected
- Oracle E-Business Suite, Workflow component (Workflow Notification Mailer), versions 12.2.3 to 12.2.15
- Releases before 12.2.3: Unknown.
Fixed in
- Fixed in Oracle's October 2026 Critical Patch Update (CPU).
- Patch number: Unknown. Take it from the risk matrix in Oracle's advisory.
- The Database and Fusion Middleware components need their own patches, listed separately in the advisory.
Workaround
- Unknown. Oracle has published no workaround; apply the October 2026 CPU patch.
- Interim measures reported by security vendors (not confirmed by Oracle): remove EBS from direct internet access where possible, and monitor EBS logs for unusual requests from external addresses.
Exploitation
- No active exploitation confirmed. Oracle does not report exploitation of this CVE.
- No public proof-of-concept confirmed.
- EPSS: 0.52% probability of exploitation within the next 30 days.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not verified directly against the CISA KEV catalogue.
Our recommendation
- If Oracle E-Business Suite 12.2.3 to 12.2.15 is deployed, apply the October 2026 CPU patches, including the separately listed Database and Fusion Middleware patches.
- If any part of EBS is reachable from the internet, treat this as urgent: restrict access and monitor logs for unusual external HTTP requests.
- Patch CVE-2026-101767 (Application Object Library) in the same window.
- If EBS is internal-only, it remains a high-priority patch within the October CPU cycle.
- If EBS is not used, no action needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- NVD record via Vulners vulners.com
- Strix CVE record (EPSS, CVSS vector) www.strix.ai
- CyberUpdates365: Oracle October 2026 patch update cyberupdates365.com
- Cyberpress: Oracle releases massive security update cyberpress.org
- SecurityOnline: Oracle E-Business Suite vulnerability CVE-2026-101809 securityonline.info
- Brandefense: Oracle October 2026 Critical Patch Update brandefense.io
- Arxdome: Oracle CPU October 2026 patches arxdome.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:11.
Original description (NVD)
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.