Oracle Workflow
Monthly
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Oracle Workflow (E-Business Suite component, versions 12.2.3-12.2.15) exposes its Workflow Loader component to unauthorized data manipulation and partial denial of service by highly privileged network attackers over HTTP. The CVSS S:C (scope changed) designation confirms that a successful attack can cascade beyond Oracle Workflow itself to affect other products within the E-Business Suite application tier, amplifying the business impact beyond what the base score of 5.5 initially suggests. No public exploit has been identified and EPSS sits at 0.04% (11th percentile), indicating negligible exploitation probability at time of analysis; SSVC likewise assesses exploitation status as none.