This vulnerability affects Oracle Workflow versions 12.2.3 to 12.2.15 in the Workflow Notification Mailer component. It requires a high privileged attacker with existing logon access to the infrastructure where Oracle Workflow executes. Exploitation can lead to denial of service by causing the service to hang or crash repeatedly. It also allows unauthorized read and write access to subsets of Oracle Workflow data, impacting confidentiality, integrity, and availability. The CVSS vector is AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H, reflecting local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality and integrity impact, and high availability impact. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches.

Successful exploitation can cause a complete denial of service (hang or frequent crashes) of Oracle Workflow. It also allows unauthorized read access to some data and unauthorized modification (update, insert, delete) of some Oracle Workflow accessible data. The impact affects confidentiality, integrity, and availability, but requires high privileges and local access to the infrastructure.

The Oracle July 2026 Critical Patch Update advisory should be consulted for patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, check the vendor advisory for current remediation guidance. No specific temporary mitigations are described.