This vulnerability affects Oracle Workflow Notification Mailer in Oracle E-Business Suite versions 12.2.3 to 12.2.15. An attacker with low privileges and network access via HTTP can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data within Oracle Workflow. Additionally, the attacker can cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact. No known exploits in the wild have been reported. Oracle has published a Critical Security Patch Update advisory for August 2026 that includes patches for this and many other vulnerabilities, strongly recommending patch application.

Successful exploitation can lead to unauthorized modification, creation, or deletion of critical Oracle Workflow data, compromising data integrity. It can also cause Oracle Workflow to hang or crash repeatedly, resulting in denial of service and impacting availability. There is no direct confidentiality impact reported.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply the relevant patches promptly to remediate the issue. No alternative mitigations or workarounds are specified by Oracle. Staying on actively-supported versions and timely patching is critical to prevent exploitation.