ORACLE has fixed a Critical flaw in E-Business Suite, CVE-2026-101809, as part of the October 2026 Critical Patch Update. The vulnerability resides in the Workflow Notification Mailer component of the Workflow product and is described as unauthenticated and reachable over HTTP, with the potential to allow an attacker to takeover the Workflow and potentially impact other connected E-Business Suite modules.
The advisory notes the issue as “easily exploitable” by an unauthenticated attacker with network access via HTTP, and indicates a scope change that could significantly affect additional products. The CVSS score for CVE-2026-101809 is 10.0, indicating maximum severity, though Oracle reports no public exploitation at the time of the advisory.
In total, the October 2026 release includes four E-Business Suite CVEs (CVE-2026-101809, CVE-2026-101767, CVE-2026-101634 and CVE-2026-101808). The most severe is CVE-2026-101809; CVE-2026-101767 affects the Core Application Object Library with a 9.8 score and also allows full takeover. Oracle states all 12.2.x versions (12.2.3 through 12.2.15) are affected, with many fixes requiring only a low-privilege account, while 31 are remotely exploitable without login.
Organisations should apply the October 2026 patches to all E-Business Suite 12.2.x instances, prioritising CVE-2026-101809 and CVE-2026-101767, and consider hardening internet exposure and restricting access to Workflow and related endpoints until patches are applied.