Oracle Workflow EUVD-2026-46937

The attacker must possess a valid low-privileged account within the Oracle E-Business Suite instance, confirmed by the CVSS PR:L metric - unauthenticated external exploitation is not possible. Network connectivity to the EBS application tier over HTTP is required (AV:N), and the Workflow Notification Mailer component must be active and accessible, which is the default configuration for EBS deployments utilizing workflow-driven business processes. No user interaction is required (UI:N) and attack complexity is Low (AC:L), meaning no race conditions or special timing windows must be exploited. Exploitation is bounded by the unchanged scope (S:U): impact is limited to Oracle Workflow's own data and service availability, not broader EBS system compromise, database access, or operating system access. The primary limiting factor is the authentication requirement - any attacker lacking a valid EBS credential cannot exploit this vulnerability directly.

The vendor-assigned CVSS 3.1 score of 6.3 (Medium) is grounded in a favorable-for-attackers vector: network reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), and unchanged scope (S:U) - but impact is bounded at partial across all three CIA dimensions (C:L/I:L/A:L). No EPSS score was available in the provided intelligence, limiting probabilistic exploitation estimation. The vulnerability is absent from CISA KEV and no public proof-of-concept code is referenced, which meaningfully reduces near-term exploitation likelihood. However, AC:L means that once an attacker holds any valid EBS credential - which in large enterprise environments can include thousands of internal users or federated external portal users - the exploitation path is mechanically simple. Oracle EBS environments often hold sensitive financial, HR, and supply chain data, so even partial read and write access to workflow records may have disproportionate business impact relative to the CVSS score. The absence of a CWE prevents confident assessment of exploitability nuances such as memory safety implications or chaining potential. No conflicting signals exist in available data, but the missing CWE and lack of EPSS are notable data gaps.

An attacker with any low-privileged EBS account - such as a standard employee self-service user or a compromised service account - sends crafted HTTP requests to the Workflow Notification Mailer endpoint on the EBS application tier. The attacker reads a subset of in-flight workflow records (e.g., pending approvals or notification payloads), inserts or modifies workflow data to alter approval outcomes or inject content, and can partially degrade Workflow service availability for other users. No public proof-of-concept code has been identified at time of analysis.