CVE-2026-60144 Overview
CVE-2026-60144 affects the Workflow Notification Mailer component of Oracle Workflow in Oracle E-Business Suite. The flaw impacts supported versions 12.2.3 through 12.2.15. Exploitation requires a local, authenticated attacker with low privileges on the infrastructure hosting Oracle Workflow. Successful attacks allow unauthorized modification of a subset of Oracle Workflow data and can trigger a partial denial of service against the workflow service. The weakness is categorized under [CWE-284: Improper Access Control]. Oracle addressed the issue as part of the July 2026 Critical Patch Update.
Critical Impact
Authenticated local attackers can alter Oracle Workflow data and degrade workflow processing, disrupting business-critical E-Business Suite automation.
Affected Products
- Oracle E-Business Suite - Oracle Workflow component
- Workflow Notification Mailer subcomponent
- Supported versions 12.2.3 through 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60144 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60144
Vulnerability Analysis
The vulnerability resides in the Workflow Notification Mailer, the component responsible for sending and processing email-based workflow notifications in Oracle E-Business Suite. Improper access control ([CWE-284]) allows a low-privileged local user to reach functionality or data that should be restricted. Attack complexity is high, meaning the attacker must satisfy specific preconditions on the host running Oracle Workflow. Successful exploitation yields limited integrity impact through unauthorized update, insert, or delete operations against workflow-accessible data, plus limited availability impact through partial service disruption. Confidentiality is not affected.
Root Cause
The root cause is improper enforcement of access controls within the Workflow Notification Mailer. The component does not adequately restrict which authenticated principals can invoke sensitive operations or modify workflow data structures. Oracle has not published detailed root-cause analysis beyond the advisory in the Oracle Critical Patch Update - July 2026.
Attack Vector
The attack vector is local. An attacker must first obtain interactive or programmatic logon to the server infrastructure where Oracle Workflow executes. From that foothold, the attacker leverages low-privileged credentials to interact with the Notification Mailer and reach the vulnerable code path. Because exploitation is not remote and requires authenticated local access, opportunistic mass exploitation is unlikely. The EPSS probability of 0.11% reflects this constrained attack surface. No public proof-of-concept or exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is available for this vulnerability. Refer to the Oracle Critical Patch Update advisory for authoritative technical details.
Detection Methods for CVE-2026-60144
Indicators of Compromise
- Unexpected INSERT, UPDATE, or DELETE statements against Oracle Workflow tables originating from Notification Mailer sessions.
- Unplanned restarts, hangs, or backlog growth in the Workflow Notification Mailer service queues.
- Local logon events from low-privileged accounts on the Oracle E-Business Suite application tier immediately preceding workflow anomalies.
Detection Strategies
- Audit database activity on WF_* schema objects and correlate changes with the identity of the Notification Mailer session.
- Monitor the concurrent manager and Workflow Mailer logs for abnormal error patterns, restarts, or authorization failures.
- Baseline normal workflow throughput and alert on partial denial-of-service symptoms such as delayed notification delivery.
Monitoring Recommendations
- Enable Oracle Database fine-grained auditing on Workflow tables and forward events to a centralized SIEM for correlation.
- Track interactive and SSH logons to E-Business Suite application-tier hosts, focusing on non-administrative accounts.
- Alert on configuration changes to the Notification Mailer through Oracle Applications Manager.
How to Mitigate CVE-2026-60144
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3-12.2.15 deployments.
- Restrict interactive and shell access on E-Business Suite application-tier servers to a minimal set of administrators.
- Review and reduce database privileges granted to workflow-adjacent accounts to enforce least privilege.
Patch Information
Oracle released fixes for CVE-2026-60144 in the July 2026 Critical Patch Update. Administrators should follow the deployment guidance in the Oracle Critical Patch Update - July 2026 advisory and validate that the patch level is applied to every application-tier node in a shared environment.
Workarounds
- Limit OS-level logon to the Oracle Workflow infrastructure to trusted administrators using centralized identity controls.
- Segment the E-Business Suite application tier from general-purpose user networks to reduce local attack opportunities.
- Increase audit logging retention on Workflow tables until patching is complete to support post-incident review.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
