Description

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:50.630Z",
  "pubdate": "2026-08-18T21:17:50.630Z",
  "executiveSummary": "This vulnerability affects the Oracle Workflow Notification Mailer component within the Oracle E-Business Suite. It is an easily exploitable availability vulnerability that can be leveraged by unauthenticated threat actors over network protocols using HTTP. Successful exploitation allows an attacker to compromise the target system, resulting in an unauthorized ability to cause a hang or a frequently repeatable crash, leading to a complete Denial of Service (DoS) of Oracle Workflow. The CVSS 3.1 base score is 7.5, indicating a high severity specifically regarding impacts to service availability. The vulnerability requires no user interaction, low attack complexity, and no privileges, making remote exploitation straightforward for any attacker with network connectivity to the vulnerable endpoint. Given the critical nature of notification mailers in enterprise resource planning environments, successful denial of service attacks can severely disrupt automated business workflows, communication pipelines, and transactional processes reliant on the Oracle E-Business Suite.",
  "technicalDetails": "The vulnerability resides within the Workflow Notification Mailer component of Oracle Workflow in Oracle E-Business Suite versions 12.2.3 through 12.2.15. The root cause stems from improper input validation or resource management when processing incoming HTTP requests handled by the affected mailer infrastructure. Because the flaw is exposed via the network vector (AV:N), an external attacker can interact directly with the vulnerable service without prior authentication (PR:N) and without requiring user interaction (UI:N). The attack complexity is rated as low (AC:L), indicating that the system lacks robust defensive mechanisms against malformed inputs or volumetric resource exhaustion triggers directed at the HTTP interface of the workflow component. During the attack flow, the adversary transmits a specially crafted HTTP request payload to the exposed Oracle Workflow interface. Upon receiving this payload, the vulnerable component fails to securely parse, bound, or handle the incoming data stream, leading to abnormal execution states such as infinite loops, memory corruption, unhandled exceptions, or thread exhaustion. This anomalous behavior immediately degrades application performance, resulting in a system hang, or triggers a fatal application fault that forces a complete, frequently repeatable crash of the Oracle Workflow service. Consequently, the operational capability of the Oracle E-Business Suite workflow engine is completely disrupted, denying legitimate users and automated processes access to core notification and messaging functionality. The impact is strictly confined to availability (A:H) with no direct compromise of confidentiality or integrity reported in the baseline vector, though the resulting operational outage presents significant business continuity risks."
}