This vulnerability affects Oracle Workflow versions 12.2.3 and involves the Workflow Notification Mailer component. An unauthenticated attacker with network access via SMTP could exploit this issue to gain unauthorized ability to update, insert, or delete certain data accessible by Oracle Workflow, as well as cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vulnerability is described as difficult to exploit. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm the patch status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Workflow accessible data and partial denial of service of Oracle Workflow. There is no confidentiality impact reported. The overall impact affects data integrity and availability at a low level.

Patch status for this vulnerability is not explicitly confirmed in the Oracle July 2026 Critical Patch Update advisory. Oracle strongly recommends applying all relevant security patches promptly and staying on actively supported versions. Users should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, limit network access to the SMTP service of Oracle Workflow where possible to reduce exposure.