Oracle Workflow CVE-2026-70931

Exploitation requires a valid low-privileged account on Oracle E-Business Suite with network access to the Workflow Notification Mailer via HTTP (PR:L, AV:N per CVSS). The Oracle description characterizes this as 'easily exploitable,' and AC:L confirms no special race conditions, timing constraints, or non-default configurations are needed. What limits exploitation is the authenticated requirement - unauthenticated external attackers cannot exploit this without first obtaining any valid EBS credential. No specific feature toggle or non-default configuration is cited as a prerequisite; any EBS deployment running Workflow Notification Mailer in the affected version range is exposed to credentialed users.

The CVSS 8.1 High score is driven by AV:N/AC:L/PR:L/UI:N with I:H and A:H impacts, making this an easily exploitable, remotely accessible flaw requiring only a low-privileged account. The absence of a confidentiality impact (C:N) limits data exfiltration risk but the combined integrity and availability destruction is operationally severe for business-process-dependent environments. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified - this is a meaningful gap given the broad EBS install base. The vulnerability is not listed in CISA KEV and no POC code has been identified, which moderates immediate exploitation urgency. However, Oracle CPU advisories are often reverse-engineered by researchers within weeks of release, and Oracle EBS environments are high-value targets. The low attack complexity and low privilege requirement mean that any insider or compromised account could trivially trigger the impact, which elevates practical risk above what CVSS alone conveys.

An attacker with a valid low-privileged Oracle EBS account (e.g., a standard business user or a compromised service account) sends a specially crafted HTTP request to the Workflow Notification Mailer endpoint, exploiting the flaw to overwrite or delete critical workflow records or induce a crash loop that renders the Workflow service unavailable. No POC code has been publicly identified, but the low complexity and absence of required user interaction mean exploitation could be scripted with minimal effort once the specific flaw is understood.