Oracle Workflow CVE-2026-60149

Exploitation is limited to attackers with a local logon session on the server infrastructure where Oracle Workflow executes - the AV:L vector explicitly rules out remote or network-based exploitation. The attacker must hold high-privileged credentials (PR:H), meaning an OS administrator, DBA, or an equivalently privileged Oracle application account with direct server access. Attack complexity is high (AC:H), meaning exploitation is not trivial and requires specific conditions to align, such as a particular application state or timing window within the Notification Mailer process. The vulnerable sub-component is specifically the Workflow Notification Mailer; installations where this mailer feature is disabled or unconfigured face reduced exposure. What limits exploitation: no remote access path exists; opportunistic or automated exploitation is unlikely given AC:H; and the attacker must already control a high-privilege account, implying a prior compromise or malicious insider.

The vendor-confirmed CVSS 3.1 score of 5.2 (Medium) accurately reflects the constrained threat model. The local attack vector (AV:L) eliminates remote network exploitation entirely - the attacker must already have an authenticated session on the infrastructure host. High privilege requirements (PR:H) further narrow the attacker population to OS-level administrators or high-privileged Oracle application accounts. High attack complexity (AC:H) indicates that exploitation is not reliable and likely depends on specific timing, state, or configuration conditions, corroborating Oracle's own 'difficult to exploit' characterization. The dominant impact is availability (A:H - complete DoS), with only minor confidentiality and integrity exposure (C:L, I:L). No EPSS score, CISA KEV listing, or proof-of-concept is available, providing no signal of active or widescale exploitation. In practice, this vulnerability represents a meaningful risk only in environments where untrusted high-privileged insiders or compromised admin accounts could reach the Workflow server directly; for organizations with strong privileged access controls, real-world risk is low despite the service-disruption potential.

An attacker who has already obtained a high-privileged local session on the Oracle EBS infrastructure host - whether through insider access or prior compromise of an admin account - could exploit a complex condition within the Workflow Notification Mailer to cause the service to hang or crash repeatedly, disrupting business process notifications and approvals across the EBS environment. Given the high complexity requirement, the attacker would likely need detailed knowledge of the mailer's internal state or require multiple attempts to trigger the condition reliably. No proof-of-concept or exploit code is publicly known.