Workflow
Monthly
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read all data accessible within the Oracle Workflow system via the Worklist HTTP component. Oracle classifies this as easily exploitable in its August 2026 Critical Patch Update, with a High confidentiality impact and no integrity or availability effects. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.
Unauthorized data disclosure in Oracle Workflow Loader (versions 12.2.3-12.2.15) allows high-privileged attackers with network access to extract sensitive information from the Oracle E-Business Suite environment. The vulnerability requires administrator-level credentials and HTTP connectivity but can result in complete exposure of workflow-accessible data. A patch is available to remediate this confidentiality issue.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read all data accessible within the Oracle Workflow system via the Worklist HTTP component. Oracle classifies this as easily exploitable in its August 2026 Critical Patch Update, with a High confidentiality impact and no integrity or availability effects. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.
Unauthorized data disclosure in Oracle Workflow Loader (versions 12.2.3-12.2.15) allows high-privileged attackers with network access to extract sensitive information from the Oracle E-Business Suite environment. The vulnerability requires administrator-level credentials and HTTP connectivity but can result in complete exposure of workflow-accessible data. A patch is available to remediate this confidentiality issue.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.