{"id":"CVE-2026-101809","published":"2026-10-20T22:18:36Z","modified":"2026-10-24T04:18:15Z","title":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer)","vendor":"Oracle Corporation","product":"Workflow","tier":"core","eol":null,"description":{"text":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Workflow Notification Mailer component of the Workflow product in Oracle E-Business Suite allows an attacker to take over Workflow. The attack requires only network access over HTTP and no authentication or user interaction, and because the scope changes, it can significantly affect additional products beyond Workflow.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:11Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00538,"percentile":0.45224,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 29, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae20c23cd267c7cddd4e545","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae0ba88997d8920e9952075","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adb741adaae4be68dd04fea","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 4/4","url":"https://otx.alienvault.com/pulse/6ad8d3528b43fc2ec5b04a43","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-106210","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106210","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101809","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.04,"detail":"percentile 0.4522"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}