Threat Intelligence Database

CVE-2026-70931 is a high severity vulnerability in Oracle Workflow component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and cause denial of service by crashing Oracle Workflow. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on integrity and availability.

CVE-2026-62547 is a high-severity vulnerability in Oracle Workflow, part of Oracle E-Business Suite, specifically affecting the Workflow Notification Mailer component. It impacts supported versions from 12.2.3 through 12.2.15. The vulnerability allows an unauthenticated attacker with network access via SMTP to potentially compromise Oracle Workflow, leading to full takeover. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 that includes security patches for multiple products, but no explicit patch or remediation details for this specific vulnerability are provided in the advisory content. Customers are urged to apply available patches promptly and remain on supported versions.

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

CVE-2026-60143 is a high-severity vulnerability in Oracle Workflow, part of Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on accessible Oracle Workflow data. Additionally, the vulnerability can cause a partial denial of service. The CVSS 3.1 base score is 7.3, reflecting impacts on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one, but no explicit patch or remediation details for this specific vulnerability are provided in the advisory content. Users are strongly advised to review Oracle's Critical Patch Update documentation and apply relevant patches promptly.

CVE-2026-34302 is a medium severity vulnerability in Oracle Workflow versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise Oracle Workflow, potentially affecting additional products. Successful exploitation can lead to unauthorized update, insert, or delete operations on Oracle Workflow accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting impacts on integrity and availability.

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Workflow accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

MediumVulnerabilityUnited KingdomGermanyFrance+7#cve#cve-2026-21959