Threats affecting pkg:maven/com.oracle.workflow/workflow

CVE-2026-91506 is a high-severity vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. It affects versions 12.2.3 through 12.2.15. The vulnerability is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to potentially take over the Workflow component. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update.

A critical vulnerability (CVE-2026-101809) exists in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow versions 12.2.3 through 12.2.15. This vulnerability allows an unauthenticated attacker with network access via HTTP to fully compromise the Workflow component, potentially impacting additional Oracle products. The vulnerability has a CVSS 3.1 base score of 10.0, indicating high confidentiality, integrity, and availability impacts. Oracle has released security patches as part of its October 2026 Critical Patch Update.

CVE-2026-70927 is a vulnerability in Oracle Workflow, part of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this flaw to cause a denial of service by hanging or crashing Oracle Workflow. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with impact on availability only.

CVE-2026-60830 is a vulnerability in Oracle Workflow component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle Workflow. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities.

CVE-2026-60149 is a vulnerability in Oracle Workflow (component: Workflow Notification Mailer) versions 12.2.3 through 12.2.15. It allows a high privileged attacker with logon access to the infrastructure running Oracle Workflow to cause denial of service by hanging or crashing the service. Additionally, the attacker can gain unauthorized read access to some data and unauthorized update, insert, or delete access to some Oracle Workflow accessible data. The vulnerability has a CVSS 3.1 base score of 5.2, indicating medium severity.