Oracle Workflow EUVD-2026-24393

Exploitation requires an authenticated attacker holding high-privilege credentials (PR:H) within the Oracle E-Business Suite environment, specifically with access to the Workflow Loader component reachable over HTTP (AV:N). No user interaction is required once the attacker has authenticated. The vulnerability targets the Workflow Loader sub-component of Oracle Workflow, meaning installations that do not expose the Workflow Loader interface or that restrict its access to a minimal set of trusted administrative accounts have materially reduced exposure. What limits exploitation: the high-privilege prerequisite (PR:H) is the primary limiting factor - this is not exploitable by low-privilege EBS users or unauthenticated external attackers. The 'Authentication Bypass' tag in metadata suggests intra-session authorization bypass (circumventing per-feature access controls within a privileged session) rather than a bypass of the initial authentication requirement. Non-standard network configurations restricting HTTP access to EBS application servers further limit the attack surface.

The aggregate risk signals place this vulnerability firmly in the low-priority tier for most organizations despite the formal CVSS 5.5 Medium score. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L requires a highly privileged authenticated attacker (PR:H), which significantly narrows the realistic threat population to insiders, compromised admin accounts, or attackers who have already achieved privileged EBS access through a prior stage of compromise. The EPSS score of 0.04% (11th percentile) reflects extremely low observed exploitation probability in the broader threat landscape. CISA SSVC corroborates this: exploitation status is assessed as none, the attack is not automatable, and technical impact is classified as only partial. Oracle has not listed this vulnerability in CISA KEV, and no public exploit or proof-of-concept code has been identified. The scope change (S:C) is the most operationally significant risk factor - an attacker with privileged access to one EBS module could affect adjacent modules - but this presupposes the high privilege prerequisite is already met. There is a minor signal conflict: the 'Authentication Bypass' tag from metadata implies access control circumvention, yet PR:H in the CVSS vector confirms high privilege is still required to initiate the attack. This suggests the bypass is intra-session (bypassing per-feature or per-data authorization checks within an already-authenticated privileged context) rather than a full authentication bypass. Organizations with strict EBS privilege separation and anomaly monitoring on Workflow Loader activity will have significantly reduced effective risk.

An attacker who has obtained or compromised a high-privilege Oracle EBS account - such as a Workflow Administrator - sends crafted HTTP requests to the Workflow Loader component targeting the access control flaw (CWE-284). The attacker leverages the improper authorization check to modify, insert, or delete workflow process definitions or associated data beyond their sanctioned scope, potentially disrupting business processes in co-hosted EBS modules due to the scope change. No public proof-of-concept code exists at time of analysis, making opportunistic exploitation unlikely; the realistic threat is a malicious insider or a lateral-movement scenario where EBS admin credentials were previously compromised.