{"id":"CVE-2026-101809","published":"2026-10-20T22:18:36.890","lastModified":"2026-10-24T04:18:15.517","description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to fully compromise the Oracle E-Business Suite Workflow component through HTTP requests, potentially leading to complete system takeover with high impacts on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to access the Workflow Notification Mailer component directly over HTTP with minimal preconditions.","blast_radius":"Successful exploitation could compromise the entire Oracle E-Business Suite workflow system and potentially impact other integrated products due to the scope change in the vulnerability's impact.","remediation":"Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite versions 12.2.3-12.2.15, specifically targeting the Workflow Notification Mailer component fixes.","detection":"Monitor for unusual HTTP GET or POST requests to /workflow/* endpoints with high volume patterns, and check for unexpected process activity in the workflow notification mailer service logs.","tags":["web","rce","workflow","ebusiness"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:16:56.841Z"}}