What is the CVSS score of CVE-2026-61278?

CVE-2026-61278 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Workflow CVE-2026-61278

EUVD-2026-47459 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g4cq-4v5f-ff52

Oracle Denial Of Service Authentication Bypass Workflow

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable via HTTP, low complexity, requires authenticated low-privileged EBS session, no user interaction, partial impacts across all three dimensions, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:06 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.

Technical ContextAI

Oracle Workflow is the workflow automation engine embedded in Oracle E-Business Suite (EBS), responsible for routing business processes, approvals, and event notifications. The Workflow Notification Mailer is the sub-component that generates and dispatches email-based workflow notifications, operating over HTTP within the EBS application tier. Affected product scope spans Oracle Workflow 12.2.3 through 12.2.15, the full range of currently supported EBS 12.2 releases. No CWE is assigned by Oracle, which is typical of Oracle CPU disclosures where root-cause classification is withheld. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a straightforward, low-complexity, network-reachable flaw exploitable by any authenticated EBS user without elevated privileges or victim interaction.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via My Oracle Support. The advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose an exact patched version number in this disclosure - consult My Oracle Support Note for the specific patch ID applicable to your EBS 12.2.x release. As a compensating control pending patching, restrict network access to the EBS application tier so that only authorized internal hosts can reach HTTP endpoints associated with the Workflow Notification Mailer; this does not eliminate risk from insider threats or compromised internal accounts but reduces the exposed attack surface. Additionally, audit and minimize the number of active EBS user accounts with Workflow-related roles, as PR:L exploitation requires at minimum a valid low-privileged session. Note that restricting Workflow Notification Mailer HTTP access may interrupt automated email notification delivery - test in non-production before applying.