What is the CVSS score of CVE-2026-62547?

CVE-2026-62547 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62547?

Oracle E-Business Suite Workflow (versions 12.2.3-12.2.15) contains a high-severity vulnerability allowing unauthenticated remote attackers to completely compromise the Workflow component via SMTP,…

How to fix or mitigate CVE-2026-62547?

Within 24 hours, identify all E-Business Suite instances running versions 12.2.3 through 12.2.15 and determine which have Workflow Notification Mailer exposed to untrusted networks; enable comprehensive audit logging on all SMTP connections. Within 7 days, implement network-level controls by restricting SMTP access to the Workflow Notification Mailer to trusted internal hosts only via firewall rules, disable the Notification Mailer component if business operations do not require it, and contact Oracle Support to request upgrade path options given no patch is currently available. Within 30 days, execute a planned upgrade to an unaffected E-Business Suite version outside the 12.2.3-12.2.15 range or permanently segment affected systems from external and untrusted network access.

Oracle E-Business Suite CVE-2026-62547

EUVD-2026-47550 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-cv5r-v7g9-545m

Authentication Bypass Oracle Workflow

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated SMTP-reachable mailer gives AV:N/PR:N/UI:N; difficult, condition-dependent exploitation warrants AC:H; component takeover yields full C:H/I:H/A:H within an unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:34 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is the Oracle Workflow Notification Mailer, the subsystem of Oracle E-Business Suite's Workflow engine responsible for sending and receiving email notifications (SMTP outbound, and IMAP/SMTP inbound response processing) tied to business-process approvals. Because the attack vector is SMTP and requires no authentication, the weakness most plausibly lies in how the mailer parses or processes inbound/relayed mail content, though Oracle does not publish root-cause detail and the CWE is listed as N/A. No CPE strings were supplied in the intelligence; affected products are identified only from the Oracle textual version range (12.2.3-12.2.15). Oracle E-Business Suite 12.2 is a Java/Oracle Database-backed ERP application stack, so a Workflow-component takeover can pivot into the broader EBS application and its stored business data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch is available per vendor advisory, though the input does not enumerate an exact patched build number per EBS release, so identify the correct CPU patch for your installed 12.2.x level from the advisory. As compensating controls until patching, restrict inbound SMTP reachability to the Workflow Notification Mailer so only trusted mail relays can deliver to it (network ACLs / firewall rules on the mailer's listening interface), and if the inbound response-processing (IMAP/SMTP) capability is not required, disable inbound processing on the mailer - the trade-off is loss of email-based approval responses. Front the mailer with a hardened mail gateway that filters and normalizes messages before they reach EBS, accepting the added mail-flow latency and operational complexity. Monitor Workflow Mailer logs for anomalous message handling as a detective control.