This vulnerability affects Oracle Workflow versions 12.2.3 to 12.2.15 and involves the Workflow Notification Mailer component. A low privileged attacker with logon access to the infrastructure can exploit this flaw to gain unauthorized ability to modify some Oracle Workflow data (update, insert, delete) and cause a partial denial of service. The CVSS 3.1 base score is 3.6 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available patches promptly. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Workflow accessible data and cause a partial denial of service affecting availability of Oracle Workflow. Confidentiality is not impacted. The attack requires local access with low privileges and is difficult to exploit, limiting the overall risk.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities in Oracle products. However, no explicit patch or remediation level for CVE-2026-60144 is stated in the advisory. Organizations should monitor Oracle's security advisories for updates and apply Critical Patch Updates promptly. Given the difficulty of exploitation and low severity, immediate emergency action is not indicated, but patching when available is advised.