Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101808updated 25 Oct 2026, 15:24 UTC

Oracle E-Business Suite Product Workbench flaw lets outsiders read and change data

Someone on the internet who does not need a password could reach the Product Workbench web page and read or change business data stored in it. Oracle has rated this as critical.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or password required
  2. 2Sends HTTP requestReaches the network-exposed web interface
  3. 3WebUI flaw triggeredProduct Workbench accepts the crafted request
  4. 4Data read or changedCritical business data is accessed
  5. ResultAttacker reads or alters Workbench data

What happened

An unauthenticated network attacker can exploit the WebUI component of Oracle Product Workbench in Oracle E-Business Suite over HTTP, gaining high confidentiality and integrity impact (CVSS 3.1 9.1).

Why it is dangerous: Attackers could create, delete, modify, or fully access data accessible through Product Workbench, which is a serious risk to business records. Organizations running affected Oracle E-Business Suite releases that expose this web interface are at risk.

Are you affected?

You are affected if you run Oracle E-Business Suite with Product Workbench in supported versions 12.2.3 through 12.2.15 and its web interface is reachable over HTTP.

Oracle E-Business Suite, Product Workbench (WebUI component), supported versions 12.2.3-12.2.15

What to do

  1. Check whether your Oracle E-Business Suite version is between 12.2.3 and 12.2.15 and whether Product Workbench is in use.
  2. Restrict network access to the Product Workbench web interface to trusted users or internal networks only.
  3. Apply the security patch or update from Oracle as soon as it is available for your version and confirm with Oracle's advisory.

Timeline

  1. 20 Oct 2026, 22:18 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-101808 · GHSA-f9g3-jfwx-m8j4
CVSS
9.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle E-Business Suite Product Workbench flaw lets outsiders read and change data · Zero Radar