Oracle E-Business Suite Workflow: Unauthenticated takeover via HTTP
Summary
CVE-2026-91506 affects the Workflow Notification Mailer component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can compromise Workflow, which Oracle describes as a possible takeover of the component. Exploitation is rated as difficult (high attack complexity). NVD scores the flaw 8.1 (High).
Affected
- Oracle E-Business Suite Workflow, component Workflow Notification Mailer
- Versions 12.2.3 to 12.2.15 (per NVD and the CVE record)
Fixed in
- Fixed in Oracle's October 2026 Critical Patch Update (CPU)
- Specific patch numbers and AD/TXK levels: Unknown. Take them from Oracle's advisory.
Workaround
- No vendor workaround known. Oracle's fix is the patch.
- Generic interim measure (not from Oracle): restrict internet access to EBS and limit access to Workflow endpoints via web application firewall or reverse proxy rules.
Exploitation
- CISA SSVC assessment in the NVD record: exploitation none, automatable no.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found.
- EPSS 0.00294.
Our recommendation
- Confirm whether EBS 12.2.3 to 12.2.15 is in use and whether Workflow Notification Mailer is enabled.
- Check whether EBS web endpoints are reachable from the internet; if so, treat as urgent.
- Apply the October 2026 CPU Workflow patches following Oracle's advisory. Oracle's advisory should also be checked for a related Workflow CVE reported by secondary sources as CVE-2026-101809.
- Review web server and mailer logs for unusual Workflow requests.
- Patch internal-only systems in the next regular window without long delay.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- OpenCVE CVE-2026-91506 app.opencve.io
- Oracle October 2026 CPU coverage (Waratek) waratek.com
- Oracle EBS Workflow vulnerability coverage (SecurityOnline) securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:13.
Original description (NVD)
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.