This vulnerability affects Oracle Workflow versions 12.2.3 through 12.2.15, specifically the Workflow Notification Mailer component. It allows an attacker with low privileges and network access via HTTP to compromise Oracle Workflow by gaining unauthorized ability to update, insert, or delete certain data, read some accessible data, and cause partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly confirm a patch for this vulnerability. The vendor strongly recommends applying patches promptly when available.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Workflow data, unauthorized read access to a subset of data, and partial denial of service affecting Oracle Workflow availability. The confidentiality, integrity, and availability impacts are rated low but combined justify a medium severity rating. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle recommends customers remain on actively supported versions and apply security patches without delay once they become available. Until a patch is released, restrict network access to Oracle Workflow HTTP interfaces to trusted users only and monitor for suspicious activity related to workflow data access.