Oracle Workflow CVE-2026-61278

The attacker must hold a valid, low-privileged Oracle E-Business Suite user account (PR:L) with network access to the EBS application tier via HTTP. No specific non-default configuration is required beyond a standard Oracle EBS 12.2.3-12.2.15 deployment with the Workflow Notification Mailer component active, which is a default component in most EBS installations. No victim user interaction is needed. Exploitation is limited by: (1) mandatory authentication - unauthenticated attackers cannot exploit this flaw; (2) scope is unchanged, so post-exploitation impact is confined to Oracle Workflow data only, not the broader EBS database or OS; (3) all confidentiality/integrity/availability impacts are rated Low, meaning individual exploit instances produce limited data exposure or disruption rather than full system compromise.

The CVSS 3.1 base score of 6.3 (Medium) reflects a realistic moderate risk: all three impact dimensions (confidentiality, integrity, availability) are rated Low, and the scope is unchanged, meaning no lateral movement to other systems is implied. The attack complexity is Low and no user interaction is required, which lowers the effort bar for exploitation. However, privileges required is Low (PR:L), meaning the attacker must have at minimum a basic authenticated EBS session - this is a meaningful limiting factor in environments with strict user provisioning. No EPSS score was provided in the available data, and this CVE has not appeared in CISA's KEV catalog, suggesting no confirmed in-the-wild exploitation. No POC code has been identified. The real-world risk is moderate: Oracle EBS environments are high-value targets in enterprise networks, and any authenticated user (including compromised service accounts) could leverage this. The partial DoS capability and data manipulation potential in a business-critical workflow system could be operationally disruptive even at the 'Low' impact rating. SSVC framing: exploitation is not yet active, the flaw appears automatable given AC:L, and technical impact is partial - this maps to a 'Track' posture for most defenders, escalating to 'Attend' if EBS is internet-facing or the user base is large.

An authenticated Oracle EBS user - such as a low-privileged employee or a compromised service account - sends a crafted HTTP request to the Workflow Notification Mailer endpoint over the internal network. Requiring no additional interaction from other users and no elevated permissions, the attacker manipulates or reads workflow notification data and intermittently disrupts the notification processing pipeline, potentially stalling approval workflows. No public exploit code exists at time of analysis, so exploitation requires independent discovery of the specific flaw.