What is the CVSS score of CVE-2026-61247?

CVE-2026-61247 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Workflow CVE-2026-61247

EUVD-2026-47437 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-w79v-j6q4-63hq

Authentication Bypass Denial Of Service Oracle Workflow

4.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

4.8 MEDIUM

Network SMTP vector with no auth required but AC:H due to exploitation prerequisites; C:N confirmed by description, I:L/A:L match partial data and service impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).

AnalysisAI

Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.

Technical ContextAI

Oracle Workflow is an embedded business process automation engine within Oracle E-Business Suite (EBS), responsible for routing documents, approvals, and notifications across enterprise workflows. The Workflow Notification Mailer is the sub-component that dispatches outgoing email via SMTP and may also process inbound responses. The vulnerability exists in the SMTP interface of this mailer, meaning crafted protocol-level input traversing the mail channel can reach vulnerable parsing or processing logic. No CWE is assigned by NVD or EUVD, which limits root-cause classification, but the CVSS vector (AV:N/AC:H/PR:N/UI:N) and SMTP attack surface are consistent with a protocol-handling or input validation weakness - possibly improper handling of SMTP command sequences or message headers. The absence of Confidentiality impact (C:N) suggests data exfiltration is not achievable, but integrity (I:L) and availability (A:L) of Workflow-accessible data and the mailer service are partially at risk.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability for Oracle E-Business Suite 12.2.x and is documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish discrete fixed build version numbers outside the CPU patch bundle, so the exact patched version is not independently confirmable from available data - follow Oracle My Oracle Support guidance for the applicable patch set. As an interim compensating control, restrict SMTP access to the Notification Mailer to only trusted internal mail relay hosts using firewall ACLs or host-based packet filtering, eliminating the unauthenticated network attack surface on the SMTP channel. Note that overly broad SMTP restrictions may interrupt legitimate outbound workflow email notifications and inbound email response processing, so network controls should be scoped precisely to permit only authorized relay hosts. Internet-facing EBS deployments with SMTP exposed externally should treat this restriction as an immediate mitigation pending patching.