CVE-2026-101847

Vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. A low privileged attacker can exploit it over the network via HTTP to take over Workflow; exploitation is difficult. CVSS 7.5.

Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to compromise Order Capture.

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session) affects versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Applications Platform Engineering.

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to compromise Sourcing.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events) affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise the product.

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to modify or delete critical data and gain unauthorized access to it.

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Installed Base.

Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base, requires human interaction and may significantly impact additional products (scope change).