What is the CVSS score of CVE-2026-60575?

CVE-2026-60575 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Workflow CVE-2026-60575

EUVD-2026-46937 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4265-4p85-9rph

Oracle Denial Of Service Authentication Bypass Workflow

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor vector is consistent with description; PR:L aligns with 'low privileged attacker,' and partial C/I/A reflect bounded workflow-data-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:06 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

MEDIUM 6.3

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.

Technical ContextAI

Oracle Workflow is an embedded process automation and routing engine bundled with Oracle E-Business Suite (EBS) 12.2.x, used to orchestrate approval chains, notifications, and business events across EBS modules. The Workflow Notification Mailer is a server-side background service responsible for sending and receiving email-based workflow notifications, processing inbound responses, and updating workflow item statuses via an HTTP-accessible interface. The affected version range spans EBS 12.2.3 through 12.2.15, a multi-year release window covering the majority of actively supported EBS 12.2 deployments. No CWE classification was provided by Oracle, which precludes definitive root-cause categorization; however, the multi-dimensional partial impact profile combined with a low-privilege network vector is consistent with an authorization control weakness or insufficient input validation within the mailer's HTTP-facing interface. The attack surface is the EBS application tier's HTTP listener rather than the database layer directly.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, announced at https://www.oracle.com/security-alerts/cpujul2026.html; the specific patch number and installation instructions are available through My Oracle Support (MOS) for each EBS 12.2.x sub-release - Oracle does not publicly disclose exact patched version identifiers. If immediate patching is not feasible, restrict network-layer access to the EBS application tier's HTTP listener to authorized internal IP ranges only, reducing external attack surface while noting this will not block exploitation by internal users with valid credentials. Additionally, Oracle EBS function security can be used to limit which responsibility profiles have access to Workflow administration interfaces, reducing the pool of accounts capable of reaching the Notification Mailer component - though this trade-off may impair legitimate workflow processing for restricted users. No vendor-published workaround was identified in available references.