CVE-2026-60149

Analyzed Analyzed - Analysis Complete

Denial of Service in Oracle Workflow

Publication date: 2026-07-21

Last updated on: 2026-07-28

Assigner: Oracle

Description

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow as well as unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-28

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60149

EUVD

EUVD-2026-46556

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	workflow	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Workflow within Oracle E-Business Suite. It allows a highly privileged attacker with local access to cause a denial of service (DOS) or crash the system repeatedly. The attacker could also read, modify, or delete some data accessible by Oracle Workflow.

Detection Guidance

Detection requires checking for Oracle Workflow versions 12.2.3 to 12.2.15. Verify installed versions using Oracle's patching tools or application logs. No specific commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability could disrupt Oracle Workflow operations, leading to system downtime or crashes. It may also allow unauthorized access to sensitive data or unauthorized modifications to system data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, which may violate compliance requirements under GDPR or HIPAA. Organizations using affected Oracle Workflow versions should address this to maintain regulatory compliance.

Mitigation Strategies

Apply Oracle's latest security patches for Workflow component. Restrict user privileges to minimize attack surface. Monitor Oracle Workflow logs for suspicious activity. Disable unnecessary services if not in use.

Hi! I’m here to help you understand CVE-2026-60149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70