This vulnerability (CVE-2026-62547) affects Oracle Workflow versions 12.2.3 through 12.2.15, specifically the Workflow Notification Mailer component. It allows an unauthenticated attacker with network access via SMTP to compromise Oracle Workflow, potentially resulting in full system takeover. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting high confidentiality, integrity, and availability impacts. The attack complexity is high, and no privileges or user interaction are required. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are recommended to review the advisory and apply patches as soon as they become available.

Successful exploitation can lead to complete compromise of Oracle Workflow, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via SMTP could take over the Oracle Workflow component, potentially allowing unauthorized control and disruption of business processes managed by Oracle Workflow.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for this vulnerability. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply security patches without delay once available. Until a patch is confirmed, restrict network access to the SMTP interface of Oracle Workflow where possible to reduce exposure.