Oracle Workflow CVE-2025-53052

Exploitation targets the Workflow Notification Mailer component of Oracle Workflow within Oracle E-Business Suite versions 12.2.3 through 12.2.14, reachable remotely over HTTP by an unauthenticated attacker (PR:N). The decisive limiting factor is mandatory interaction from a human other than the attacker (UI:R) - a legitimate EBS user must open or act on the malicious notification - so this is not self-propagating and depends on social engineering. Impact is partial (unauthorized read of a subset of data; unauthorized insert/update/delete of some data; no availability impact), and the scope change (S:C) means successful attacks may affect products/components beyond Oracle Workflow itself. No non-default configuration prerequisite is stated in the advisory beyond running an affected EBS 12.2.x version with the Workflow Notification Mailer in use.

This is a moderate-risk issue whose signals are largely consistent and point AWAY from urgent, widespread exploitation. The CVSS 3.1 base score is 6.1 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N: network-reachable and low-complexity with no privileges, but crucially requiring user interaction (UI:R) and yielding only partial Confidentiality and Integrity impact (C:L/I:L) and no Availability impact (A:N). The scope change (S:C) is the one aggravating factor, indicating the flaw in Oracle Workflow can impact additional products/components beyond its own security authority - consistent with a content-injection/XSS-style issue in the Workflow Notification Mailer where attacker-controlled content reaches another user's session. EPSS is low at 0.23% (13th percentile), it is NOT listed in CISA KEV, and no public exploit code was identified, so there is no confirmed active exploitation. The UI:R requirement means this is not a drive-by, unauthenticated-RCE-class bug and realistically depends on social engineering (a victim opening/interacting with a malicious notification). Note a minor tension: CWE-284 (Improper Access Control) and the 'Authentication Bypass' tag imply a privilege/access problem, whereas the UI:R + S:C + C:L/I:L profile reads much more like a cross-site-scripting / content-injection flaw than a true authentication bypass - the tag may overstate the nature of the vulnerability; verify against Oracle's October 2025 CPU advisory. Bottom line: a legitimate but non-emergency patch priority - schedule it in the normal Oracle CPU cycle rather than treating it as actively-exploited.

An unauthenticated attacker crafts a malicious workflow notification (e.g., with injected content in a field rendered by the Workflow Notification Mailer) and gets it delivered to an EBS user. When that user interacts with the notification, the payload executes in the context of their session or another component (scope change), allowing limited unauthorized read of some data and unauthorized update/insert/delete of a subset of Workflow data. No public exploit code was identified at time of analysis, and exploitation hinges on tricking a legitimate user into interacting.