Description
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Workflow accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Workflow Notification Mailer component in Oracle E‑Business Suite contains an authorization flaw. A low‑privileged attacker who can reach the application over HTTP can exploit the flaw to create, delete, or modify critical data accessed through Oracle Workflow. The same flaw also enables the attacker to cause the service to or repeatedly crash, resulting in a complete denial of service.

Affected Systems

Oracle Workflow versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS 3.1 base score of 8.1 indicates high severity with significant integrity and availability impact. Because the attack is network‑based via HTTP and only requires low privileges, the vulnerability is likely easily exploitable. The EPSS score of 0.00404 indicates a very low exploit probability, and the flaw is not listed in CISA’s KEV catalog, yet its combination of exploitability and damage potential warrants urgent attention.

Generated by OpenCVE AI on August 22, 2026 at 04:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle's latest security patch or upgrade Oracle Workflow to a version beyond 12.2.15.
  • Restrict HTTP access to the Workflow Notification Mailer endpoint by limiting traffic to trusted hosts or implementing firewall rules.
  • Disable or remove the Workflow Notification Mailer feature if it is not required in your environment.

Generated by OpenCVE AI on August 22, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Low-Privileged Oracle Workflow Notification Mailer Exploit Enables Unauthorized Data Changes and Denial of Service
Weaknesses CWE-285

Wed, 19 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low-Privileged Oracle Workflow Notification Mailer Exploit Enables Unauthorized Data Changes and Denial of Service
Weaknesses CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Workflow accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle workflow
CPEs cpe:2.3:a:oracle:workflow:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle workflow
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Workflow
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T02:48:44.548Z

Reserved: 2026-08-04T22:06:34.606Z

Link: CVE-2026-70931

cve-icon Vulnrichment

Updated: 2026-08-22T02:48:38.538Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:51.097

Modified: 2026-08-28T14:44:17.083

Link: CVE-2026-70931

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T04:30:06Z

Weaknesses