A vulnerability exists in Oracle E-Business Suite's Workflow Notification Mailer component. The weakness is an access control vulnerability (CWE-284) that allows an unauthenticated attacker with network access via HTTP to fully compromise the Workflow environment. The successful exploitation leads to loss of confidentiality, integrity, and availability, allowing the attacker to take ownership of the Workflow application. The vulnerability permits remote code execution and is identified as a high severity weakness.

Oracle Corporation's Workflow product in Oracle E-Business Suite, specifically the Workflow Notification Mailer component. Affected versions are 12.2.3 through 12.2.15. Users of these versions are directly impacted.

The CVSS 3.1 Base Score of 10.0 reflects an extremely severe risk. The vulnerability requires no authentication, and with a low attack complexity an adversary can exploit it from any network host that can reach the exposed HTTP service. The EPSS score of 0.00522 indicates that the likelihood of exploitation is low at this time, yet the total impact of a successful exploit would compromise confidentiality, integrity, and availability of the Workflow application. This vulnerability is currently not listed in the CISA KEV catalog, but its high severity and potential scope change justify a high priority for rapid remediation.