Oracle E-Business Suite Workflow flaw CVE-2026-101809 scores CVSS 10.0 in October patch update

TLDR

• Oracle's 20 October Critical Patch Update fixes CVE-2026-101809, an unauthenticated HTTP flaw in E-Business Suite Workflow, scored CVSS 10.0.¹⁶
• It affects versions 12.2.3 to 12.2.15; Oracle's advisory lists 1,295 patches and CSO Online counts six rated 10.0.¹³
• NVD's CISA entry lists exploitation as "none" on 23 October; Rapid7 shows no CISA KEV listing.²⁴

Oracle's October 2026 Critical Patch Update, released on 20 October, includes CVE-2026-101809, a flaw in the Workflow product of Oracle E-Business Suite, in the Workflow Notification Mailer component.¹⁶ Oracle describes it as an easily exploitable vulnerability that lets an unauthenticated attacker with network access over HTTP compromise Workflow, with a scope change that means attacks may significantly affect additional products.¹ Successful attacks can result in takeover of Workflow, and Oracle scores it CVSS 3.1 10.0 with high confidentiality, integrity and availability impact.¹² Oracle lists affected supported versions as 12.2.3 to 12.2.15 and says earlier versions of affected releases are likely affected too, though they are not tested.¹ For patch details, Oracle's E-Business Suite section points customers to My Oracle Support Note KA923, and Rapid7 lists the fix as the October 2026 CPU, patch 40022426:12.2.0.¹⁴

The flaw is one of 194 new security patches for E-Business Suite in the update, 31 of which Oracle says may be remotely exploitable without authentication.¹ Across all products, Oracle's advisory lists 1,295 new security patches.¹ CSO Online, which says its article first appeared on CIO, reports that six of the flaws scored 10.0 on CVSS 3.1: this one, three in Oracle SOA Suite, one in Oracle Access Manager and one in JD Edwards EnterpriseOne Orchestrator.³ CSO Online describes the 1,295 as vulnerabilities, while BaseTech says the 1,295 patches cover 1,209 unique vulnerabilities, a figure it takes from SecurityOnline's summary.³⁷ Oracle says it releases security patches on the third Tuesday of each month, and its advisory lists 17 November 2026 as the next date.¹⁶

On exploitation status, the NVD record, published on 20 October and last modified on 24 October, was still marked "Awaiting Analysis" and includes a CISA SSVC entry dated 23 October listing exploitation as "none", automatable as "yes" and technical impact as "total".² Rapid7 shows the CVE as not in the CISA Known Exploited Vulnerabilities catalogue, and Tenable lists the same 20 October publication and 24 October update dates as NVD.⁴⁵ Oracle's advisory carries a general warning, not specific to this CVE, that it continues to receive reports of attempts to exploit vulnerabilities it has already patched and that attackers have in some cases succeeded where customers had not applied patches.¹

A separate E-Business Suite flaw from the same update, CVE-2026-101767 in Oracle Application Object Library, is rated 9.8 in Oracle's matrix.¹ BaseTech reports that honeypots recorded the first exploratory exploitation attempts in this update on 27 October, against CVE-2026-101767, not CVE-2026-101809.⁷ Oracle's advisory shows a second revision on 26 October that updated a credit name, Siebel CRM versions and credits for two other CVEs.¹

Why it matters: a maximum-score flaw that needs no credentials or user interaction puts the October update on the patch list for Workflow customers on 12.2.3 to 12.2.15, though the NVD record listed exploitation as none on 23 October.¹²