CVE-2026-34302
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vulnerability in Oracle Workflow (Workflow Loader component) of Oracle E-Business Suite affects versions 12.2.3-12.2.15. A high-privileged attacker with HTTP network access can easily exploit it to gain unauthorized update, insert or delete access to some data and cause a partial denial of service.
Risk Assessment
This can result in unauthorized changes to workflow data and availability disruptions, and due to scope change the attack may also impact other products.
Recommendation
Apply the Oracle E-Business Suite update containing the fix and restrict access to the Oracle Workflow HTTP interface to trusted users.
Other vulnerabilities in Oracle Workflow
See all- CVE-2026-70926Critical
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) allows an unauthenticated attacker with network access via SMTP to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-91506High
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer), affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access to take over Workflow.
- CVE-2026-70931High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause complete denial of service.
- CVE-2026-70927High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow.
- CVE-2026-60830Medium
Vulnerability in Oracle Workflow (component: Worklist) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data or full access to data.
- CVE-2026-62547High
Vulnerability in Oracle Workflow (Workflow Notification Mailer) in Oracle E-Business Suite versions 12.2.3-12.2.15. Difficult to exploit, allows unauthenticated attacker via SMTP to take over Oracle Workflow. CVSS 8.1 (high impact on confidentiality, integrity, availability).
- CVE-2026-61247Medium
Vulnerability in the Workflow Notification Mailer component of Oracle Workflow (Oracle E-Business Suite). An unauthenticated attacker via SMTP can perform unauthorized data modifications and cause partial DoS, but exploitation is difficult.
- CVE-2026-60780High
Vulnerability in Oracle Workflow (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker with network access via SMTP to take over the system.
- CVE-2026-60575Medium
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read, write, and delete access to data and cause a partial denial of service.
- CVE-2026-60149Medium
Vulnerability in Oracle Workflow (Workflow Notification Mailer component) versions 12.2.3-12.2.15. Requires privileged local access and is difficult to exploit. Can lead to complete denial of service (DOS) and unauthorized read, write, and modification of data.
Original NVD description (English source)
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Workflow. While the vulnerability is in Oracle Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS