This vulnerability in Oracle Workflow (component: Internal Operations) allows an unauthenticated attacker with network access via SMTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.3. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not specifically confirm patch availability or remediation for Oracle Workflow or this CVE. No known exploits in the wild are reported.

Successful exploitation can lead to complete compromise of Oracle Workflow, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over Oracle Workflow operations, potentially affecting business processes relying on this component.

Oracle has published a Critical Patch Update advisory for July 2026 that addresses numerous vulnerabilities across many products. However, the advisory content provided does not explicitly confirm a patch or remediation for CVE-2026-60780 in Oracle Workflow. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions.