Oracle Workflow CVE-2026-60780

Exploitation requires network access to the Oracle Workflow SMTP mailer interface of an Oracle E-Business Suite 12.2 deployment running an affected Workflow version (12.2.3-12.2.15) with the SMTP-based Workflow notification/mailer path active - SMTP is the exact protocol named in the description. No authentication (PR:N) and no user interaction (UI:N) are needed. Exploitation is limited by high attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit,' indicating the attacker must meet conditions beyond their direct control (such as specific mailer configuration, message timing, or environmental state), which meaningfully constrains reliable attacks despite the unauthenticated network vector. Environments that do not expose the Workflow inbound mailer to reachable networks, or that have the inbound mailer disabled, are not exposed via this path.

The signals are mixed and should be weighed carefully. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) shows a remote, unauthenticated attacker with no user interaction and full CIA impact - a serious profile - but AC:H (Oracle explicitly calls it 'difficult to exploit') materially lowers real-world likelihood, implying dependence on timing, configuration, or conditions the attacker cannot fully control. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the data; the absence of KEV and any exploit reference suggests no confirmed active exploitation at this time. Oracle EBS is a high-value target and its Workflow mailer has a history of being attacked, so despite AC:H this warrants prompt patching rather than deferral. Note a tension in the source data: Oracle tags this 'Information Disclosure,' yet the vector and description indicate full integrity/availability impact and component takeover - verify the true impact scope against Oracle's advisory.

An attacker with network reach to the Oracle Workflow SMTP mailer sends specially crafted email traffic to the EBS Workflow inbound processing endpoint, triggering the flaw during mail handling without any credentials or user interaction. A successful attack results in takeover of the Oracle Workflow component. The high attack complexity means the attacker likely needs to satisfy specific timing or configuration conditions, so reliable exploitation is not trivial; no public POC was identified in the provided data.