CVE-2026-62547
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle Workflow (Workflow Notification Mailer) in Oracle E-Business Suite versions 12.2.3-12.2.15. Difficult to exploit, allows unauthenticated attacker via SMTP to take over Oracle Workflow. CVSS 8.1 (high impact on confidentiality, integrity, availability).
Risk Assessment
An attacker can take over Oracle Workflow, leading to compromise of data processed by workflows, modification, or denial of access.
Recommendation
Apply the security patch provided by Oracle for the affected E-Business Suite version. Restrict SMTP server access to trusted hosts only.
Other vulnerabilities in Oracle Workflow
See all- CVE-2026-70926Critical
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) allows an unauthenticated attacker with network access via SMTP to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-70931High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause complete denial of service.
- CVE-2026-70927High
Vulnerability in Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow.
- CVE-2026-60830Medium
Vulnerability in Oracle Workflow (component: Worklist) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data or full access to data.
- CVE-2026-61247Medium
Vulnerability in the Workflow Notification Mailer component of Oracle Workflow (Oracle E-Business Suite). An unauthenticated attacker via SMTP can perform unauthorized data modifications and cause partial DoS, but exploitation is difficult.
- CVE-2026-60780High
Vulnerability in Oracle Workflow (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker with network access via SMTP to take over the system.
- CVE-2026-60575Medium
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read, write, and delete access to data and cause a partial denial of service.
- CVE-2026-60149Medium
Vulnerability in Oracle Workflow (Workflow Notification Mailer component) versions 12.2.3-12.2.15. Requires privileged local access and is difficult to exploit. Can lead to complete denial of service (DOS) and unauthorized read, write, and modification of data.
- CVE-2026-60143High
Vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to modify, read, and partially block data.
Original NVD description (English source)
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).