Oracle EBS Workflow CVE-2026-91506

Exploitation targets the Workflow Notification Mailer component of Oracle E-Business Suite Workflow, versions 12.2.3 through 12.2.15, and requires network HTTP reachability to that component - realistically, an EBS instance whose Workflow/mailer endpoints are exposed to the attacker. No authentication (PR:N) and no user interaction (UI:N) are required. The primary limiting factor is attack complexity (AC:H): Oracle describes it as 'difficult to exploit,' indicating success depends on a specific server condition, timing window, or state the attacker cannot fully control, rather than a single reliable request. Organizations that do not expose Workflow Mailer HTTP endpoints to untrusted networks, or that run versions outside 12.2.3-12.2.15, are not reachable by this vector.

This is a genuinely high-priority flaw, though the signals are mixed and some are absent. The confirmed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated attack requiring no user interaction that yields full confidentiality, integrity, and availability compromise ('takeover of Workflow'), which drives the 8.1 Base Score. The one tempering signal present in the vendor data is AC:H - Oracle explicitly labels it a 'difficult to exploit' vulnerability, implying the attacker must win a race, satisfy a timing/state precondition, or chain specific circumstances rather than fire a single deterministic request. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code was referenced, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The result is a classic 'high-severity, high-complexity, unauthenticated' Oracle EBS issue: patch urgency is justified by the unauthenticated full-takeover outcome and EBS's internet-facing exposure, but the real-world exploitation likelihood is currently moderated by attack complexity and the absence of a known exploit. Note the input Tags list 'Information Disclosure,' which conflicts with the C:H/I:H/A:H full-takeover impact in the description - treat this as a tagging artifact, not a scoping limitation.

An attacker who can reach the Oracle E-Business Suite Workflow Notification Mailer over HTTP sends a specially crafted request that, under the right server state, is processed by the mailer component and leads to full compromise of the Workflow product. Because the vector is AV:N/PR:N/UI:N, no credentials or victim interaction are needed, but AC:H means the attacker must satisfy a non-trivial precondition or timing window to succeed. No public proof-of-concept was referenced in the provided data.