CVE-2026-60144 in Workflow
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Workflow component of the Oracle E-Business Suite, specifically within the Workflow Notification Mailer module. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure across multiple release cycles. The vulnerability is classified as difficult to exploit, requiring an attacker to first establish valid credentials on the infrastructure where Oracle Workflow operates, suggesting that initial access is already compromised or obtained through other means.
The technical flaw manifests as a privilege escalation issue within the workflow notification mailer system, where an authenticated low-privileged user can leverage their access to compromise the underlying workflow processes. This vulnerability creates unauthorized update, insert, and delete capabilities against data accessible through the workflow component, while simultaneously enabling partial denial of service conditions that can disrupt workflow operations. The CVSS 3.1 scoring of 3.6 reflects the moderate impact across both integrity and availability vectors, with the base score indicating a low to medium severity threat.
The operational impact of this vulnerability extends beyond simple data manipulation as it creates potential for service disruption within the workflow environment. An attacker could compromise workflow processes that may affect business operations, particularly those involving approval workflows, notifications, and automated business processes that depend on the workflow engine's integrity. The partial denial of service aspect suggests that while complete system shutdown is not guaranteed, specific workflow functionalities could be rendered unavailable or degraded, potentially impacting enterprise operations.
The vulnerability's exploitability requirements include having a valid login to the infrastructure hosting Oracle Workflow, which aligns with attack patterns documented in the MITRE ATT&CK framework under privilege escalation and credential access techniques. This classification places the vulnerability within the context of lateral movement and persistence strategies that attackers might employ after initial compromise. Organizations should consider implementing network segmentation and access controls to limit potential impact, while also ensuring proper patch management protocols are maintained across all supported versions.
From a compliance standpoint, this vulnerability could potentially violate various security standards including those outlined in the CWE (Common Weakness Enumeration) catalog under weakness categories related to privilege escalation and insufficient authorization. The attack vector AV:L indicates local access requirements, which provides some protection against remote exploitation but does not eliminate the risk entirely, particularly in environments where physical or administrative access might be compromised.
Organizations should prioritize immediate assessment of their Oracle E-Business Suite installations to identify affected versions and implement appropriate mitigations including patch deployment, network monitoring for suspicious activities, and implementation of least privilege principles for workflow-related accounts. The vulnerability's characteristics suggest that while exploitation requires initial access, the potential impact on workflow integrity and availability makes it a critical concern for enterprise security teams responsible for protecting business-critical processes.