CVE-2026-60143 in Workflow
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Workflow product, specifically in the Workflow Notification Mailer component which serves as a critical communication mechanism for workflow notifications and process automation. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple releases of the enterprise suite. The vulnerability represents a significant security weakness that can be exploited by unauthenticated attackers who gain network access through HTTP protocols, eliminating the need for prior authentication or privileged access to initiate exploitation attempts.
The technical flaw manifests as an insufficient access control mechanism within the Workflow Notification Mailer component, allowing malicious actors to bypass normal authentication procedures and directly interact with workflow processes. This vulnerability operates at the application layer and leverages HTTP communication channels to execute attacks, making it particularly dangerous as it requires minimal prerequisites for exploitation. The flaw essentially creates a backdoor pathway that enables attackers to manipulate workflow data without proper authorization, fundamentally undermining the security controls that should govern access to enterprise workflow processes.
The operational impact of this vulnerability extends across multiple confidentiality, integrity, and availability dimensions as defined by the CVSS 3.1 scoring system. Attackers can achieve unauthorized update, insert, or delete operations against sensitive workflow data, potentially corrupting business processes and undermining operational continuity. The ability to perform unauthorized read access to specific workflow data subsets compromises confidentiality, allowing attackers to extract sensitive information about business processes, user activities, and organizational workflows. Additionally, the partial denial of service capability can disrupt workflow automation, causing operational delays and potentially impacting critical business functions that depend on timely workflow processing.
The CVSS 3.1 base score of 7.3 reflects the severity of this vulnerability, with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicating low attack complexity, no privilege requirements, and universal impact across the affected scope. This classification aligns with CWE-285, which addresses improper authorization issues in access control systems, and maps to ATT&CK technique T1078 for valid accounts and T1499 for endpoint disruption. Organizations utilizing Oracle E-Business Suite versions within the affected range face significant risk of workflow process manipulation, data exposure, and service disruption that could impact business operations and regulatory compliance.
Mitigation strategies should prioritize immediate patching of affected Oracle E-Business Suite installations to address the identified vulnerability in Workflow Notification Mailer. Network-level controls including firewall rules and access control lists should be implemented to restrict HTTP access to workflow components, while monitoring systems should be enhanced to detect unusual workflow activity patterns. Organizations should also implement network segmentation to limit lateral movement capabilities for potential attackers and establish robust incident response procedures specifically addressing workflow data integrity violations. Regular security assessments and vulnerability scanning of Oracle E-Business Suite environments should be conducted to identify similar access control weaknesses and maintain ongoing protection against evolving threat landscapes.