A vulnerability in the Workflow component’s Notification Mailer allows an attacker with network access via HTTP to compromise the Workflow service without requiring authentication. The flaw is difficult to exploit and requires only low‑privileged access, yet successful exploitation can lead to takeover of the Workflow system, resulting in confidentiality, integrity, and availability breaches as reflected in the CVSS‑3.1 base score of 7.5.

Oracle E‑Business Suite Workflow versions 12.2.3 through 12.2.15 are impacted.

The documented vector indicates an unauthenticated HTTP request as the attack path; the high impact CVSS score and suspected difficulty of exploitation justify monitoring and timely action. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, but the potential for full workflow compromise warrants prompt remediation.