Description

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Workflow accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:51.097Z",
  "pubdate": "2026-08-18T21:17:51.097Z",
  "executiveSummary": "A security vulnerability exists within the Oracle Workflow product of Oracle E-Business Suite, specifically localized to the Workflow Notification Mailer component.\nThe vulnerability affects supported product versions 12.2.3 through 12.2.15.\nAn attacker possessing low privileges and network access via the HTTP protocol can exploit this flaw to compromise the Oracle Workflow system.\nSuccessful exploitation requires no user interaction and can result in unauthorized creation, deletion, or modification of critical data, as well as all data accessible via Oracle Workflow.\nFurthermore, successful attacks can cause a hang or a frequently repeatable complete denial of service (DoS) of the targeted Oracle Workflow instance.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting high impacts to data integrity and system availability without affecting confidentiality.\nRisk implications include severe operational disruption and unauthorized manipulation of core business workflow data.",
  "technicalDetails": "The vulnerability resides in the Workflow Notification Mailer component of Oracle Workflow within Oracle E-Business Suite versions 12.2.3 to 12.2.15.\nThe flaw stems from insufficient access controls and input validation mechanisms within the HTTP-exposed interfaces handling mailer operations and workflow transactions.\nAn attacker with network access and low-privileged authentication can interact directly with the vulnerable HTTP endpoints exposed by the Oracle E-Business Suite application layer.\nThe attack flow begins with the low-privileged adversary crafting specialized HTTP requests designed to bypass existing functional restrictions within the Workflow Notification Mailer.\nBy transmitting these malicious payloads over the network, the attacker interacts with backend Oracle Workflow logic that improperly handles the input or state changes.\nThis improper handling allows the execution of unauthorized data modification, creation, or deletion routines against critical database tables and application structures managed by Oracle Workflow.\nAdditionally, the payload can be structured to exhaust system resources or trigger unhandled exceptions within the mailer component, leading to a complete denial of service characterized by application hangs or repeatable system crashes.\nThe attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N).\nThe scope remains unchanged (S:U), while the impact is strictly concentrated on high integrity (I:H) and high availability (A:H) violations, leaving confidentiality (C:N) unimpacted."
}