CVE-2026-60149: Medium severity Oracle Oracle Workflow (Workflow Notification Mailer) vulnerability
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow as well as unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Workflow (Workflow Notification Mailer)to a version that resolves this vulnerability.Fixed in 12.2.15 - Compensating control
Because the vulnerability can be exploited by a high-privileged attacker with logon to the infrastructure where Oracle Workflow executes, restrict and harden access to the Oracle Workflow execution infrastructure to reduce the likelihood of authenticated access by unauthorized users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60149?
The severity of CVE-2026-60149 is classified as medium with a score of 5.2.
How do I fix CVE-2026-60149?
To fix CVE-2026-60149, it is recommended to apply the latest security patches provided by Oracle for affected versions.
What are the supported versions affected by CVE-2026-60149?
The supported versions affected by CVE-2026-60149 are 12.2.3 to 12.2.15 of Oracle E-Business Suite.
What is the impact of CVE-2026-60149?
CVE-2026-60149 allows a high privileged attacker to exploit the vulnerability with logon access to the Oracle Workflow infrastructure.
Is CVE-2026-60149 difficult to exploit?
Yes, CVE-2026-60149 is considered a difficult to exploit vulnerability.