CVE-2026-60143 is a vulnerability in the Workflow Notification Mailer component of Oracle Workflow within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows unauthenticated attackers with network access over HTTP to compromise Oracle Workflow by gaining unauthorized ability to read, update, insert, or delete certain accessible data, and to cause partial denial of service. The vulnerability is categorized under CWE-284 (Improper Access Control). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized read access to some Oracle Workflow data, unauthorized modification (update, insert, delete) of accessible data, and partial denial of service conditions affecting Oracle Workflow availability. This compromises confidentiality, integrity, and availability of affected Oracle Workflow instances.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends applying patches without delay. However, no explicit patch or remediation level is confirmed for CVE-2026-60143 in the advisory content provided. Users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until patches are applied, restrict network access to Oracle Workflow HTTP interfaces where possible to reduce exposure.