CVE-2026-101808
CriticalCVSS 9.1Summary
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized creation, deletion, or modification access to critical data.
Risk Assessment
A high CVSS 9.1 score indicates serious risk of confidentiality and integrity breaches. The attack requires no authentication and can be performed remotely.
Recommendation
Promptly install Oracle updates for Oracle E-Business Suite. Restrict access to the WebUI interface and review logs for unauthorized changes.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-91496High
Vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. A low privileged attacker can exploit it over the network via HTTP to take over Workflow; exploitation is difficult. CVSS 7.5.
- CVE-2026-101809Critical
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to compromise Workflow, potentially impacting other products.
- CVE-2026-101767Critical
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Application Object Library.
- CVE-2026-101634Critical
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data and cause a hang or frequently repeatable crash (DoS).
- CVE-2026-62549Critical
Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.
- CVE-2026-46817CriticalActively exploited
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
- CVE-2025-62481Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2025-53072Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2026-83428High
Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83425High
Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.
Original NVD description (English source)
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS