CVE-2026-60575
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Workflow product, specifically in the Workflow Notification Mailer component, representing a significant security weakness that affects versions 12.2.3 through 12.2.15. The flaw manifests as an easily exploitable security gap that can be leveraged by low-privileged attackers who gain network access through HTTP protocols. The vulnerability's accessibility and potential impact make it particularly concerning for organizations utilizing Oracle E-Business Suite environments, as it creates multiple attack vectors for unauthorized system compromise.
The technical nature of this vulnerability stems from insufficient input validation and authentication mechanisms within the Workflow Notification Mailer component. Attackers can exploit this weakness to gain unauthorized access to sensitive workflow data through HTTP connections, potentially manipulating the system's integrity by performing unauthorized updates, inserts, or deletions of workflow-related information. The attack requires minimal privileges and network connectivity, making it accessible to threat actors with basic technical capabilities. This vulnerability directly maps to CWE-287 (Improper Authentication) and CWE-311 (Missing Encryption of Sensitive Data) categories, highlighting fundamental security design flaws in the authentication and data protection mechanisms.
The operational impact of this vulnerability extends beyond simple data access compromises, as it enables attackers to cause partial denial of service conditions that can disrupt normal business operations. Successful exploitation allows unauthorized read access to specific subsets of Oracle Workflow accessible data, potentially exposing sensitive business information or workflow processes. The confidentiality, integrity, and availability impacts are all rated as medium severity in the CVSS 3.1 scoring system, with a base score of 6.3 indicating a moderate risk level that requires immediate attention. This vulnerability's partial denial of service capability can significantly disrupt workflow processes and business continuity, particularly in mission-critical Oracle E-Business Suite implementations.
Organizations should implement immediate mitigations including applying the relevant Oracle security patches and updates to address this vulnerability. Network segmentation and access controls should be strengthened to limit HTTP access to the affected components, while monitoring systems should be enhanced to detect suspicious activities related to workflow notification mailer operations. The ATT&CK framework categorizes this vulnerability under privilege escalation and credential access techniques, making it particularly dangerous in environments where attackers can leverage initial access to escalate privileges and maintain persistent presence within the Oracle E-Business Suite infrastructure. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in related components of the Oracle ecosystem, as this vulnerability represents a potential entry point for more extensive system compromises that could affect entire enterprise data repositories.