What is the CVSS score of EUVD-2026-46552?

EUVD-2026-46552 has a CVSS 3.1 base score of 3.6 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Oracle Workflow EUVD-2026-46552

| CVE-2026-60144 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-p3x8-9rc9-vgpr

Authentication Bypass Denial Of Service Oracle Oracle Workflow Oracle Corporation

3.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.6 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.6 LOW

Local access and low-privilege OS logon are mandatory; high complexity and no confidentiality impact align with Oracle's own vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).

AnalysisAI

Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.

Technical ContextAI

Oracle Workflow is a business process automation engine embedded in Oracle E-Business Suite (EBS), a comprehensive ERP platform. The affected component, the Workflow Notification Mailer, handles automated email-based notifications for workflow events and approvals. The CPE string (cpe:2.3:a:oracle_corporation:oracle_workflow:*:*:*:*:*:*:*:*) confirms this targets the Oracle Corporation's Workflow application across the 12.2.x release train. No CWE is assigned by Oracle or NVD, which is characteristic of Oracle's CPU advisory practice of omitting root-cause classifications. Given the local attack vector and the combination of integrity and availability impacts on data the mailer manages, the flaw likely resides in a file-system-level operation, inter-process communication, or configuration handling accessible to local OS-level users on the EBS application tier. The absence of a confidentiality impact suggests data exposure is not a concern - only manipulation and disruption of workflow records.

RemediationAI

The primary remediation is applying Oracle's July 2026 Critical Patch Update (CPU), available via Oracle's support portal and detailed in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish granular patch version strings in CPU advisories; the exact patch bundle and application instructions are accessed through My Oracle Support (MOS). No patch version has been independently confirmed from the available reference data - treat patch availability as 'confirmed per Oracle advisory' only. As a compensating control prior to patching, restrict OS-level logon access to the EBS application tier servers to only essential DBAs and system administrators, since AV:L requires physical or remote shell access to the host. Additionally, audit and limit the set of OS users who can interact with the Oracle Workflow Notification Mailer process directory and spool files. These controls reduce exposure but do not eliminate it; applying the CPU patch remains the definitive fix.