CVE-2026-60143: Oracle Workflow Auth Bypass Vulnerability

CVE-2026-60143 Overview

CVE-2026-60143 affects the Oracle Workflow product within Oracle E-Business Suite, specifically the Workflow Notification Mailer component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful exploitation can result in unauthorized create, update, or delete access to Workflow data. It can also grant unauthorized read access to a subset of Workflow data and cause a partial denial of service. Oracle addressed the flaw in the July 2026 Critical Patch Update. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
An unauthenticated remote attacker can compromise Oracle Workflow over HTTP, altering data and degrading service availability without user interaction.

Affected Products

Oracle E-Business Suite — Oracle Workflow 12.2.3
Oracle E-Business Suite — Oracle Workflow versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Workflow 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60143 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60143

Vulnerability Analysis

The vulnerability resides in the Workflow Notification Mailer component of Oracle Workflow, part of Oracle E-Business Suite. The Workflow Notification Mailer processes and dispatches workflow notifications between the E-Business Suite database and external mail systems over HTTP. Attackers reach the vulnerable interface across the network without prior authentication. Exploitation requires no user interaction and no elevated privileges. Successful attacks yield limited confidentiality, integrity, and availability impact rather than full system takeover. The listed weakness is [CWE-284] Improper Access Control, indicating the component fails to enforce sufficient authorization checks on requests it accepts.

Root Cause

Oracle's advisory attributes the flaw to improper access control within the Workflow Notification Mailer. The component processes HTTP-borne requests without enforcing authorization sufficient to protect the underlying Workflow data. This allows external callers to reach data operations that should be restricted to authenticated Workflow contexts. The current EPSS probability is 0.304% with a percentile of 22.596.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated attacker sends crafted HTTP requests to a reachable Workflow Notification Mailer endpoint on an affected Oracle E-Business Suite deployment. No credentials, tokens, or user interaction are required. Once the request is accepted, the attacker can insert, update, or delete a subset of Workflow-accessible data, read a subset of Workflow data, and induce a partial denial of service against the Workflow component. Oracle E-Business Suite instances exposed directly to the internet or to untrusted network segments face the highest risk.

No verified public proof-of-concept code is available. Refer to the Oracle July 2026 Security Alert for vendor technical details.

Detection Methods for CVE-2026-60143

Indicators of Compromise

Unexpected HTTP requests to Workflow Notification Mailer endpoints originating from external or untrusted networks.
Unauthorized inserts, updates, or deletes in Oracle Workflow tables without a corresponding authenticated user session.
Anomalous Workflow Notification Mailer process restarts, hangs, or error spikes suggesting partial denial-of-service activity.
Outbound notifications or workflow events that do not correlate with legitimate business processes.

Detection Strategies

Baseline normal HTTP traffic patterns to Oracle E-Business Suite hosts and alert on deviations targeting Workflow Notification Mailer URIs.
Correlate database audit records for Workflow tables against authenticated application session logs to identify unattributed changes.
Monitor Oracle Workflow logs for repeated failed or malformed requests indicative of enumeration or exploitation attempts.

Monitoring Recommendations

Enable and forward Oracle E-Business Suite application, Workflow, and database audit logs to a centralized analytics platform for retention and correlation.
Alert on new external source IPs interacting with Workflow Notification Mailer HTTP endpoints.
Track availability metrics for the Workflow Notification Mailer service to detect partial denial-of-service conditions early.

How to Mitigate CVE-2026-60143

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Restrict network access to Workflow Notification Mailer endpoints so only trusted internal systems can reach them over HTTP.
Inventory internet-facing Oracle E-Business Suite instances and prioritize them for patching and network isolation.
Review Workflow and database audit logs since July 2026 for signs of unauthorized activity.

Patch Information

Oracle addressed CVE-2026-60143 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle July 2026 Security Alert and apply the patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or web application firewall that enforces authentication and filters unexpected requests to Workflow Notification Mailer paths.
Limit HTTP exposure of the Workflow Notification Mailer to internal management networks using firewall access control lists.
Disable the Workflow Notification Mailer service where it is not required for business operations until patching is complete.

bash

# Configuration example: restrict HTTP access to Oracle E-Business Suite Workflow endpoints
# Replace 10.0.0.0/8 with your trusted internal CIDR ranges
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP