CVE-2026-60575: Oracle Workflow Auth Bypass Vulnerability

CVE-2026-60575 Overview

CVE-2026-60575 is a vulnerability in the Oracle Workflow product of Oracle E-Business Suite, specifically within the Workflow Notification Mailer component. Affected versions span 12.2.3 through 12.2.15. The flaw is remotely exploitable over HTTP and requires only low privileges, with no user interaction.

Successful exploitation grants attackers unauthorized update, insert, or delete access to a subset of Oracle Workflow data. Attackers can also gain read access to some Workflow data and cause a partial denial of service. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can modify Workflow data, read sensitive Workflow information, and partially disrupt service availability across Oracle E-Business Suite deployments running versions 12.2.3-12.2.15.

Affected Products

Oracle E-Business Suite - Oracle Workflow 12.2.3 through 12.2.15
Workflow Notification Mailer component
Environments exposing Oracle Workflow HTTP endpoints to authenticated users

Discovery Timeline

2026-07-21 - CVE CVE-2026-60575 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60575

Vulnerability Analysis

The vulnerability resides in the Workflow Notification Mailer component of Oracle Workflow. This component processes and delivers workflow notifications, typically via email, and interfaces with Workflow data structures within Oracle E-Business Suite. An authenticated attacker with low privileges can send crafted HTTP requests to interact with the Workflow service in unintended ways.

Exploitation yields limited but meaningful impact across all three security properties. Attackers gain partial confidentiality loss through read access to a subset of Workflow data. They also achieve partial integrity impact through unauthorized insert, update, or delete operations. Availability degrades through a partial denial of service against Workflow functionality.

Because the attack surface is network-reachable and does not require user interaction, exploitation can be automated once an attacker obtains valid low-privilege credentials. Credential access through phishing, password reuse, or leaked service accounts is a realistic prerequisite in most enterprise environments.

Root Cause

Oracle has not published detailed root-cause information beyond the Critical Patch Update advisory. The Workflow Notification Mailer performs authorization and input handling that fails to fully restrict a low-privileged principal from performing state-changing operations on Workflow data. Refer to the Oracle Security Alert July 2026 for vendor-provided context.

Attack Vector

The attack originates over the network via HTTP against an Oracle E-Business Suite instance running an affected Workflow version. The attacker must hold valid credentials with low privileges on the target application. No user interaction is required, and the scope remains unchanged, meaning the impact is contained within the vulnerable Oracle Workflow component.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.272% (19.232 percentile) as of 2026-07-23.

Detection Methods for CVE-2026-60575

Indicators of Compromise

Unexpected HTTP requests to Oracle Workflow Notification Mailer endpoints originating from low-privileged user sessions
Anomalous INSERT, UPDATE, or DELETE activity against Workflow tables (WF_*) outside normal batch or business hours
Partial service degradation or timeouts in Workflow Notification Mailer processes without corresponding infrastructure incidents
Authentication events for low-privilege Workflow accounts from unusual source IPs or geographies

Detection Strategies

Enable Oracle E-Business Suite audit policies for Workflow-related tables and Notification Mailer configuration changes
Correlate HTTP access logs from the E-Business Suite application tier with database audit trails to identify low-privilege sessions triggering write operations
Baseline normal Workflow Notification Mailer request patterns and alert on statistical deviations in request volume or endpoint diversity

Monitoring Recommendations

Forward E-Business Suite application, web tier, and database audit logs to a centralized SIEM for cross-source correlation
Monitor Workflow service processes for restarts, crashes, or elevated error rates indicating partial denial-of-service conditions
Track credential use for Workflow-related accounts and alert on concurrent sessions or off-hours activity

How to Mitigate CVE-2026-60575

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Workflow versions 12.2.3 through 12.2.15
Inventory all E-Business Suite instances to confirm patch coverage, including non-production and disaster recovery environments
Rotate credentials for low-privileged accounts that can reach Workflow endpoints, particularly service and integration accounts
Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted internal networks and VPN users

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for the specific patch identifiers applicable to their E-Business Suite version and platform. Apply the update in a test environment first, then promote through change control to production.

Workarounds

Limit access to the Workflow Notification Mailer through network segmentation and web application firewall rules that restrict which authenticated users can reach the endpoint
Enforce least-privilege on Workflow responsibilities so that low-privileged users cannot reach sensitive Workflow functions
Disable the Workflow Notification Mailer service if it is not required for business operations until the patch is applied
Increase audit logging on Workflow tables to accelerate identification of exploitation attempts prior to patching

bash

# Verify installed Oracle E-Business Suite patch level
# Run from the APPL_TOP environment on the application tier
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM   ad_bugs
WHERE  bug_number IN ('<July 2026 CPU patch numbers>')
ORDER  BY last_update_date DESC;
EXIT;
EOF