This vulnerability in the Oracle E‑Business Suite Workflow Notification Mailer component allows an unauthenticated attacker with network access over HTTP to compromise the entire Workflow system. The weakness is an authentication bypass (CWE‑306) that gives the attacker the ability to execute arbitrary actions, resulting in full takeover and impacting confidentiality, integrity and availability.

Oracle Corporation’s Workflow product, part of the E‑Business Suite, is affected for versions 12.2.3 through 12.2.15. The flaw resides in the Workflow Notification Mailer and applies only when the component is reachable over HTTP from the public or external network.

The CVSS base score of 8.1 indicates a high severity, and the EPSS score of < 1% shows a low current exploitation likelihood. The vulnerability is not yet listed in CISA KEV, suggesting no widespread public exploit. However, because the flaw permits unauthenticated access over network traffic, attackers could easily target exposed HTTP endpoints and gain full control of Workflow processes if the exploit is applied. The high impact combined with the ability to authenticate through the network makes this a critical risk for exposed systems.