What is the CVSS score of CVE-2026-60149?

CVE-2026-60149 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Oracle Workflow CVE-2026-60149

EUVD-2026-46556 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-w4cr-3q99-r385

Authentication Bypass Oracle Oracle Workflow Oracle Corporation

5.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.2 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

5.2 MEDIUM

Local-only vector and high privileges match the description's infrastructure-logon requirement with elevated credentials; AC:H reflects Oracle's confirmed 'difficult to exploit' classification.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:28 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow as well as unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).

AnalysisAI

Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.

Technical ContextAI

Oracle Workflow is a business process automation engine embedded in Oracle E-Business Suite (EBS), responsible for routing approvals, notifications, and workflow events across EBS modules. The vulnerable sub-component is the Workflow Notification Mailer, which handles outbound email notifications for workflow events via SMTP. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_workflow:*:*:*:*:*:*:*:*, covering versions 12.2.3 through 12.2.15. No CWE classification has been assigned, so the precise root cause class (e.g., resource exhaustion, race condition, logic flaw) within the mailer process is not formally disclosed. The impact profile - high availability loss with limited confidentiality and integrity effects - is consistent with a resource or concurrency issue in a long-running service process, though this remains unconfirmed absent a CWE or vendor technical disclosure.

RemediationAI

The primary remediation is to apply Oracle's July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability within the Oracle Workflow component. An exact fixed version number is not independently confirmed from available data - organizations should consult the Oracle CPU patch matrix to identify the specific patch for their 12.2.x EBS installation. As a compensating control prior to patching, restrict local operating system logon access to the Oracle Workflow server to only the minimum set of trusted, named administrative accounts, reducing the pool of potential attackers; this may require reviewing and tightening sudoers or OS group memberships, with care not to lock out legitimate operational roles. Monitoring the Workflow Notification Mailer process for unexpected restarts, hangs, or resource spikes can aid early detection. Note that restricting OS-level access may affect automated patching or monitoring agents that rely on local infrastructure access.