Oracle Product Workbench EUVD-2026-106209

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Product Workbench (the WebUI component of Oracle E-Business Suite), per AV:N/AC:L/PR:N/UI:N. The only prerequisites are network reachability to the Product Workbench WebUI HTTP endpoint and a running affected version in the 12.2.3-12.2.15 range. Limiting factors: exploitation requires the Product Workbench module to be deployed and its WebUI accessible to the attacker (e.g., internet-exposed or reachable from the attacker's network segment); environments that restrict EBS WebUI access to internal/VPN-only networks materially reduce exposure. No authentication, user interaction, or non-default configuration is required.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible exposure profile: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction, meaning a remote unauthenticated attacker can exploit it directly. The 9.1 score reflects High confidentiality and High integrity impact (A:N - no availability impact), consistent with unauthorized read and create/modify/delete access to all Product Workbench data. Countering this, the dynamic exploitation signals are currently weak or absent: there is no EPSS score provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or widespread exploitation yet. The signals are therefore consistent rather than conflicting - a severe, easily exploitable flaw that has not yet shown measurable real-world weaponization. Given Oracle E-Business Suite's history of being heavily targeted (and prior EBS CVEs reaching KEV), this should be patched urgently despite the current lack of exploitation telemetry; the absence of EPSS/KEV/POC data is a monitoring gap, not evidence of safety.

A remote attacker with no credentials sends crafted HTTP requests to an internet-facing or intranet-reachable Oracle Product Workbench WebUI endpoint, abusing an authentication-bypass-class flaw to reach protected functionality. Without needing to log in or trick a user, the attacker reads sensitive business data and creates, modifies, or deletes records across all Product Workbench-accessible data. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and no-interaction requirement make reliable exploitation straightforward once details are known.