EUVD-2026-61873
GHSA-ch9m-g9f4-67x2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Notification Mailer over SMTP
-
DeliverySend crafted mail message
-
ExploitTrigger flaw in mailer processing
-
ExecutionCompromise Oracle Workflow
-
ImpactFull takeover (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have network reachability to the Oracle Workflow Notification Mailer over SMTP on a system running Oracle E-Business Suite Oracle Workflow 12.2.3-12.2.15; the SMTP-based mail-handling path is the required feature/interface. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no privileges, and no user interaction are needed against affected versions. The principal limiting factor is exposure: exploitation depends on the Notification Mailer being reachable by the attacker (e.g., internet-facing or accessible from a compromised internal/partner network) and on the EBS instance being an affected 12.2.x release with the mailer enabled - installations that do not run the Notification Mailer or that restrict its mail path to trusted relays materially reduce reachability. |
| Impact | This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector is unambiguous: network attack vector, low complexity, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact (9.8) with Oracle explicitly stating 'easily exploitable' and 'takeover of Oracle Workflow.' Countervailing signals: no EPSS probability was supplied, the CVE is not in CISA KEV, and no public exploit code has been identified, so exploitation appears not yet weaponized despite the maximal severity - meaning the risk is currently potential and patch-driven rather than confirmed active. One tension worth verifying: the description tags include 'Information Disclosure,' yet the CVSS asserts full C/I/A impact and 'takeover,' so the vendor severity is broader than the tag suggests - trust the CVSS/'takeover' language over the tag. Because EBS is an internet-adjacent ERP core and the entry point is SMTP mail handling, any organization running EBS 12.2.x with an internet- or partner-reachable Notification Mailer should treat this as urgent and patch on Oracle's CPU cycle. |
| Exploit ScenarioDerived | An unauthenticated attacker who can deliver mail traffic to the Oracle Workflow Notification Mailer sends a crafted SMTP message that abuses the mailer's handling logic, requiring no credentials and no user interaction (AV:N/AC:L/PR:N/UI:N). Successful processing leads to full takeover of Oracle Workflow with high confidentiality, integrity, and availability impact. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Apply the fix from Oracle's August 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cspuaug2026.html); Oracle distributes EBS Workflow fixes as CPU patches rather than a single tagged product version, so identify and apply the specific CPU patch for your installed 12.2.x release from that advisory (exact patch numbers are not reproduced in the provided data and should not be invented). Until patched, reduce exposure by restricting network reachability of the Workflow Notification Mailer: ensure the inbound/outbound mail path (SMTP/IMAP) is not exposed to untrusted or internet-facing networks and is filtered to trusted mail relays only - trade-off is that legitimate external notification email flows may be disrupted and require an approved relay allowlist. If the Notification Mailer is not required, consider disabling the mailer service, accepting that workflow email notifications will stop. Place EBS behind network segmentation and monitor the mailer host for anomalous SMTP activity as a compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Workflow is the business-process/notification engine embedded in Oracle E-Business Suite (EBS), Oracle's ERP suite. The affected surface is the Workflow Notification Mailer, the subsystem responsible for sending and receiving email notifications tied to workflow processes; it communicates over SMTP (outbound send) and IMAP (inbound response processing). Exploitation reaches the product 'via SMTP,' indicating the mail-handling/notification path is the entry point rather than the EBS web tier. Oracle labels this an Oracle Workflow product issue affecting EBS releases 12.2.3-12.2.15. The CWE is not assigned (N/A) in the source data, so the precise root-cause class (e.g., injection or unsafe parsing of mail content) cannot be confirmed from the provided intelligence.
Know when Workflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor states unauthenticated, easily exploitable network attack over SMTP with no user interaction resulting in full takeover, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 contains a critical unauthenticated network vulnerability (CVSS 9.8) that permits complete system compromise via SMTP, directly threatening organizations' financial controls and operational continuity. No vendor-released patch identified at time of analysis. Immediate network containment is mandatory to prevent attackers from gaining unrestricted access to sensitive financial data and business processes.
Network segmentation restricting SMTP access to authorized systems only; intrusion detection/prevention system rules targeting exploitation patterns on affected Oracle EBS versions; comprehensive logging and alerting for SMTP authentication failures and Workflow Notification Mailer exceptions; temporary disabling of non-critical SMTP-dependent notification workflows; daily security log review for indicators of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Rated
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Rated high severity (CVSS
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised b
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possib
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthentic
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthentic
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authent
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromise
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authent
Oracle E-Business Suite's Workflow Notification Mailer component (Oracle Workflow, versions 12.2.3 through 12.2.14) can
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is r
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Rated
Exploit-DB