Oracle Workflow CVE-2026-61247

Exploitation requires unauthenticated network access to the SMTP port associated with Oracle Workflow's Notification Mailer component on Oracle E-Business Suite versions 12.2.3 through 12.2.15. The AC:H designation indicates that beyond simple network reachability, additional conditions outside the attacker's direct control must be met - such as a specific operational state of the mailer service, a timing window, or a protocol race condition. The Notification Mailer component must be actively configured and running for the SMTP attack surface to exist; EBS installations that have not enabled or configured the Notification Mailer are not exposed. No user interaction is required and no authentication is needed, but the high attack complexity materially limits exploitation reliability. Impact is constrained to partial data modification and partial service disruption within Oracle Workflow - confidentiality of data is not at risk, and scope is unchanged (no lateral movement to other systems).

The CVSS 3.1 base score of 4.8 (Medium) accurately reflects the constrained impact profile: partial integrity and availability degradation with no confidentiality exposure, and a high attack complexity (AC:H) that significantly limits opportunistic exploitation. AC:H in Oracle CPU advisories typically signals that specific conditions outside attacker control - such as race conditions, particular server state, or non-default configuration - must align for exploitation to succeed. EPSS data is absent from available intelligence, preventing probabilistic exploit forecasting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no proof-of-concept has been identified. The combination of AC:H, limited impact scope, no active exploitation evidence, and no public exploit code makes this a lower-priority item relative to other Oracle CPU findings; however, SMTP-exposed EBS Notification Mailer instances in internet-accessible environments warrant patching within standard Oracle CPU cadence. The missing CWE classification is a data gap that prevents precise root-cause risk modeling.

An unauthenticated attacker with network access to the SMTP port of an Oracle EBS Notification Mailer sends a specially crafted SMTP session or message payload designed to exploit the parsing or processing vulnerability. The attacker must satisfy the AC:H exploit conditions - likely specific timing, server state, or protocol sequencing - to succeed. On success, the attacker achieves limited unauthorized modification or deletion of Oracle Workflow data, or degrades the availability of the Notification Mailer, without gaining read access to confidential data or achieving broader system compromise.