This vulnerability affects the Workflow Notification Mailer component of Oracle Workflow in Oracle E-Business Suite versions 12.2.3 to 12.2.15. An unauthenticated attacker with network access via SMTP can exploit this flaw to compromise Oracle Workflow, leading to full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in high confidentiality, integrity, and availability impacts. Oracle has published a Critical Security Patch Update (CSPU) advisory for August 2026 addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly. However, explicit patch availability or remediation details for this specific CVE were not provided in the advisory content.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle Workflow, impacting confidentiality, integrity, and availability of the affected system. This could lead to complete takeover of Oracle Workflow, potentially affecting business processes relying on this component.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the latest security patches without delay and remain on actively supported versions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the most current patch and remediation guidance.