EUVD-2026-46551
GHSA-vgxp-xq69-qgm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS Workflow HTTP endpoint
-
DeliverySend crafted mailer request
-
ExploitBypass access controls unauthenticated
-
ExecutionRead/modify subset of Workflow data
-
ImpactTrigger partial Workflow DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected deployment must be running Oracle E-Business Suite with the Oracle Workflow product and the Workflow Notification Mailer component reachable over HTTP, at supported version 12.2.3 through 12.2.15. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration are stated as required - exploitation targets network-reachable EBS Workflow instances directly. The primary limiting factors are therefore network exposure of the EBS/Workflow HTTP endpoint (an internet-facing versus internal-only deployment materially changes real risk) and running an affected 12.2.x version; impact is inherently bounded to a subset of Workflow data and partial DoS (C:L/I:L/A:L), not full compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 HIGH) is internally consistent and points to a genuinely low-barrier issue: network reachable over HTTP, low attack complexity, no privileges, no user interaction, but with each of confidentiality, integrity and availability capped at Low and no scope change. Oracle's own 'easily exploitable' language reinforces the AC:L/PR:N reading. Offsetting this, there is no EPSS score provided, no SSVC decision data, no POC, and no CISA KEV listing, so there is no evidence of active or automated exploitation - the priority rests on ease of exploitation and the typical high value of EBS systems, not on observed attacks. Because impacts are partial rather than full (no total takeover, only a subset of data and partial DoS), this is a real but bounded priority: patch promptly given the unauthenticated network vector, but it is not a full-compromise emergency on the raw signals available. |
| Exploit ScenarioDerived | An attacker with only network reachability to the EBS server sends crafted HTTP requests to the Workflow Notification Mailer interface without any credentials, given the low-complexity, no-authentication vector. They read a subset of Workflow-accessible data and perform limited unauthorized insert, update or delete operations, or send malformed input to cause a partial denial of service of Oracle Workflow. No public POC is identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-sanctioned remediation for all affected 12.2.3-12.2.15 releases; Oracle strongly recommends applying CPU patches without delay. An exact standalone fix version is not enumerated in the provided data beyond the CPU reference, so treat 'Patch available per vendor advisory' as the patch status and map the correct patch to your EBS 12.2.x level from the CPU. Until patching, compensating controls include restricting network access to the Workflow Notification Mailer and EBS HTTP endpoints to trusted networks/VPN and placing them behind a reverse proxy or WAF that filters malformed requests, disabling outbound/inbound mailer processing if the notification-mailer function is not in active use (trade-off: workflow email notifications stop), and tightening egress/ingress on the SMTP/IMAP and HTTP ports the mailer uses. These controls reduce exposure but do not close the underlying flaw, so patching remains required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Workflow Notification Mailer, the subsystem within Oracle Workflow (part of Oracle E-Business Suite EBS 12.2.x) that sends and receives email notifications tied to workflow processes, typically communicating over SMTP/IMAP and exposed via HTTP-facing EBS servlets. Oracle assigned no CWE (listed N/A), but the described impact - partial reads plus limited write and DoS reachable without authentication over HTTP - is consistent with an input-validation or access-control weakness in the mailer's HTTP-reachable interface rather than full data compromise. The single CPE, cpe:2.3:a:oracle_corporation:oracle_workflow:*:*:*:*:*:*:*:*, confirms Oracle Workflow as the affected package, and the constrained C:L/I:L/A:L impacts indicate the attacker touches only a subset of Workflow-accessible data rather than the whole EBS instance.
Know when Oracle Workflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
HTTP-reachable, unauthenticated, low-complexity per Oracle (AV:N/AC:L/PR:N/UI:N); impacts limited to a subset of data and partial DoS, so C/I/A each Low with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Executive ViewAI
Oracle E-Business Suite Workflow Notification Mailer (versions 12.2.3-12.2.15) is vulnerable to unauthorized remote access by unauthenticated attackers, enabling theft of workflow data and partial service disruption. Organizations running affected EBS versions risk exposure of sensitive approval workflows, business process information, and operational continuity of mission-critical notification systems.
Network segmentation and access controls restricting Workflow Notification Mailer to authorized internal networks only; disable HTTP and enforce HTTPS-only communication; Web Application Firewall rules limiting Workflow component endpoint exposure; intrusion detection signatures for CVE-2026-60143 exploitation attempts; comprehensive audit logging with daily review of unauthorized Workflow data access and modifications; disable unused Workflow Notification Mailer instances where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Workflow
View allOracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthori
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contain
Exploit-DB