Oracle E-Business Suite EUVD-2026-106210

Exploitation requires network reachability to the Oracle E-Business Suite Workflow Notification Mailer over HTTP; per CVSS PR:N/UI:N it is unauthenticated and needs no user interaction against affected versions 12.2.3-12.2.15. The primary limiting factor is exposure: the EBS instance (and specifically the Workflow Notification Mailer functionality) must be reachable by the attacker, so deployments restricted to internal networks or placed behind access controls materially reduce real-world risk. No special non-default configuration is called out in the description as a prerequisite, and the scope change means impact can extend to additional products beyond Workflow.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximum 10.0: fully remote, low attack complexity, no privileges, no user interaction, with a scope change and complete confidentiality, integrity, and availability loss. The target is the Workflow Notification Mailer in Oracle E-Business Suite, an internet-reachable component that has historically been a favored target for mass exploitation of EBS deployments. The scope change (S:C) is significant - Oracle explicitly states attacks 'may significantly impact additional products,' meaning compromise does not stay contained to Workflow. Key signals are MISSING from the provided data: no EPSS score, no CISA KEV status, and no POC indicator were supplied, so exploitation likelihood cannot be quantified from the input. The 'no public exploit identified at time of analysis' status reflects absence of evidence in this dataset, not confirmed absence of exploitation. Given a CVSS 10.0 unauthenticated RCE-class flaw in a widely deployed, internet-facing ERP, defenders should treat this as emergency-patch priority regardless of the missing EPSS/KEV signals. One tag inconsistency: the input tags this as 'Information Disclosure,' which understates a vulnerability Oracle describes as full takeover with C/I/A all High.

An unauthenticated attacker locates an internet-facing Oracle E-Business Suite instance and sends crafted HTTP requests to the Workflow Notification Mailer component, requiring no credentials or user interaction. Because the attack complexity is low and the scope changes, successful exploitation yields takeover of Workflow and can cascade into additional Oracle EBS products. No public exploit was identified in the provided data, but the low-complexity unauthenticated profile makes reliable weaponization likely.