Oracle E-Business Suite CVE-2026-62547

Exploitation requires network SMTP access to the Oracle Workflow Notification Mailer component of an EBS 12.2.3-12.2.15 instance, with no authentication needed (PR:N) and no user interaction (UI:N). The key limiting factor is CVSS AC:H: the attack is rated difficult to exploit, implying dependence on conditions the attacker does not fully control - most plausibly that the Notification Mailer is deployed and reachable for inbound/relayed mail and processes attacker-influenced message content. Environments where the mailer does not accept externally originated SMTP, or where inbound processing is disabled, materially reduce exposure.

The signals partially conflict on urgency. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) marks this as high severity with unauthenticated network reach and total impact on the Workflow component, but the AC:H metric explicitly signals that exploitation is difficult and likely requires conditions outside the attacker's direct control (e.g., specific mailer configuration, timing, or crafted-message handling). No EPSS score, KEV entry, POC, or SSVC decision data was provided, so there is no evidence of active or automatable exploitation - meaning the real-world priority currently rests on the raw CVSS and the sensitivity of EBS deployments rather than on confirmed exploitation. This should be treated as a high-priority patch for internet- or partner-reachable EBS mail interfaces, while recognizing the practical exploitation bar is elevated by AC:H. Note the reference tag says 'Information Disclosure' yet the CVSS records full C/I/A impact and 'takeover' - verify the true impact against Oracle's CPU advisory.

An attacker who can deliver SMTP traffic to an organization's Oracle Workflow Notification Mailer sends a specially crafted email designed to abuse the mailer's message processing, and - after satisfying the difficult preconditions implied by AC:H - gains control of the Oracle Workflow component without any credentials. From that foothold the attacker can read, alter, or destroy workflow-driven business data and processes. No public exploit code is known at time of analysis, so this would require independent exploit development.