CVE-2026-61247
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vulnerability in the Workflow Notification Mailer component of Oracle Workflow (Oracle E-Business Suite). An unauthenticated attacker via SMTP can perform unauthorized data modifications and cause partial DoS, but exploitation is difficult.
Risk Assessment
Risk of integrity and availability breaches in workflow processes, potentially disrupting business processes relying on email notifications.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15 and monitor SMTP traffic for suspicious requests.
Other vulnerabilities in Oracle Workflow
See all- CVE-2026-70926Critical
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) allows an unauthenticated attacker with network access via SMTP to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-70931High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause complete denial of service.
- CVE-2026-70927High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow.
- CVE-2026-60830Medium
Vulnerability in Oracle Workflow (component: Worklist) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data or full access to data.
- CVE-2026-62547High
Vulnerability in Oracle Workflow (Workflow Notification Mailer) in Oracle E-Business Suite versions 12.2.3-12.2.15. Difficult to exploit, allows unauthenticated attacker via SMTP to take over Oracle Workflow. CVSS 8.1 (high impact on confidentiality, integrity, availability).
- CVE-2026-60780High
Vulnerability in Oracle Workflow (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker with network access via SMTP to take over the system.
- CVE-2026-60575Medium
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read, write, and delete access to data and cause a partial denial of service.
- CVE-2026-60149Medium
Vulnerability in Oracle Workflow (Workflow Notification Mailer component) versions 12.2.3-12.2.15. Requires privileged local access and is difficult to exploit. Can lead to complete denial of service (DOS) and unauthorized read, write, and modification of data.
- CVE-2026-60143High
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to modify, read, and partially block data.
Original NVD description (English source)
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).