Oracle Workflow CVE-2026-70927

No special conditions beyond HTTP network reachability to the Oracle Workflow Notification Mailer service are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation with no required user interaction or non-default configuration. The Notification Mailer service must be running, which is a standard operational state for EBS deployments that use workflow-based approvals or email notifications. Limiting factors include network segmentation: if the EBS application tier is isolated behind a firewall or DMZ with access restricted to known internal subnets, the attack surface is substantially reduced. Only Oracle EBS installations running versions 12.2.3 through 12.2.15 are confirmed affected; versions outside this range are not confirmed vulnerable by available data.

The CVSS 3.1 score of 7.5 reflects a high-severity availability impact with the most permissive network profile: AV:N/AC:L/PR:N/UI:N indicates this is trivially exploitable by any unauthenticated remote attacker over HTTP without any user interaction. Oracle's own advisory language - 'easily exploitable' - independently corroborates the low attack complexity rating. However, the blast radius is strictly limited to availability (C:N/I:N/A:H); there is no data exfiltration or code execution pathway indicated. EPSS data was not included in the provided intelligence, so automated exploitation probability cannot be quantified. The absence of a CISA KEV listing and no reported public exploit code suggest this is not currently under mass exploitation, but the trivial attack requirements mean weaponization risk is non-trivial. Organizations with the EBS application tier exposed to untrusted network segments face meaningful operational continuity risk. Those with strict network segmentation around EBS have meaningfully reduced exposure.

An unauthenticated attacker with HTTP access to the Oracle EBS application tier sends a crafted request to the Workflow Notification Mailer endpoint, triggering an unhandled condition that causes the mailer service to hang or crash. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and Oracle classifies this as easily exploitable, the attacker can repeat this trivially to sustain a persistent denial-of-service, preventing workflow notifications and potentially disrupting broader EBS business processes dependent on the Workflow engine. No public exploit code has been identified at time of analysis.