What is the CVSS score of CVE-2026-60780?

CVE-2026-60780 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Workflow are affected by CVE-2026-60780?

Oracle Workflow within E-Business Suite (versions 12.2.3-12.2.15) is vulnerable to complete remote takeover by unauthenticated attackers via SMTP, affecting organizations' core financial and…

How to fix or mitigate CVE-2026-60780?

Within 24 hours: Inventory all Oracle E-Business Suite deployments and confirm versions in use; restrict SMTP network access to Oracle Workflow to only authorized systems. Within 7 days: Implement segmentation rules blocking external SMTP traffic to affected instances, enable authentication logging and alerting on SMTP connections, and document Workflow dependencies. Within 30 days: Engage Oracle for patch timeline confirmation; develop a migration plan to non-vulnerable versions (12.2.16 or later, or Oracle Fusion); evaluate temporary SMTP traffic inspection or intrusion detection rules as interim controls.

Oracle Workflow CVE-2026-60780

EUVD-2026-47099 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v86w-4j7w-gmpx

Authentication Bypass Oracle Workflow

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote SMTP reach with no auth or interaction (AV:N/PR:N/UI:N); Oracle-stated 'difficult to exploit' justifies AC:H; component takeover gives full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:36 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Workflow is the embedded business-process automation and notification engine within Oracle E-Business Suite (EBS) 12.2, used to route approvals, alerts, and notifications, frequently via email over SMTP. The affected component is 'Internal Operations,' and the attack surface is the SMTP-based notification/mailer processing path, where inbound or crafted mail is parsed and acted upon by the Workflow engine. No CWE was assigned in the source data, and Oracle's advisory tags this as Information Disclosure; combined with the C:H/I:H/A:H vector and the 'takeover' language, the root cause class is not disclosed by Oracle but the impact is full compromise of the Workflow component. Exact affected products are Oracle Workflow 12.2.3-12.2.15 as shipped with Oracle EBS 12.2; no CPE strings were provided in the intelligence.

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS fixes as CPU patch sets rather than a renamed product version, so identify and apply the specific 12.2 CPU patch for your EBS release - an exact standalone fix version was not provided in the input and should be taken directly from the Oracle advisory (Patch available per vendor advisory). Because the vector is SMTP-based, effective compensating controls until patching include restricting inbound SMTP connectivity to the EBS Workflow mailer to trusted mail relays only, placing the Workflow inbound mailer behind a filtering gateway, and disabling or tightly scoping the inbound (processing) Workflow mailer if inbound email actions are not required - with the trade-off that inbound email-based notification responses and approvals will stop functioning. Network-segment the EBS application tier so the SMTP listener is not reachable from untrusted networks. Do not rely on these controls as a permanent substitute for the CPU patch.