Oracle Workflow CVE-2026-60144

Exploitation requires that the attacker has an authenticated OS-level logon (low privilege, PR:L) to the specific infrastructure host where Oracle Workflow executes - not merely a network connection or an EBS application account. The attack vector is local (AV:L), meaning remote network exploitation is not possible without first achieving local access through another means. Attack complexity is High (AC:H), indicating that exploiting this vulnerability is not straightforward and may depend on timing, race conditions, or specific system state that cannot be reliably controlled. The Workflow Notification Mailer sub-component must be active and processing notifications. Exploitation is limited to partial data integrity corruption and partial denial of service of the Workflow component only - confidentiality is not affected. Broad lateral impact beyond Oracle Workflow is not indicated by the unchanged scope (S:U).

Multiple signals converge on a low real-world risk rating. The CVSS 3.1 base score of 3.6 (Low) reflects AV:L (local access required), AC:H (high exploitation complexity), and PR:L (authenticated low-privileged OS user required). No EPSS score is available in the provided data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no POC is known. The SSVC exploitation status is therefore 'none' - no public exploit, no observed active exploitation. The technical impact is limited: only partial integrity and partial availability are affected, with no confidentiality impact (C:N). An attacker must already have local logon access to the server infrastructure running Oracle Workflow, which in well-managed EBS environments is tightly controlled. This is not a remotely exploitable, unauthenticated, or high-impact vulnerability. Priority should be low unless the environment has unusually broad local user access to the EBS application tier.

A low-privileged OS user who has already obtained a shell session on the Oracle EBS application server - for example, a developer account or a compromised service account - manipulates files or IPC channels associated with the Workflow Notification Mailer under difficult-to-reproduce race or timing conditions. The attacker inserts or modifies workflow notification records, potentially redirecting approvals or corrupting workflow state, and may cause the Mailer component to become partially unresponsive, disrupting automated business process notifications. No public proof-of-concept exists, and the high attack complexity (AC:H) means reliable exploitation requires non-trivial effort.