CVE-2026-46963 is a critical security vulnerability in Oracle Universal Work Queue (component: Work Provider Site Level Administration) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP, enabling compromise and potential takeover of the Oracle Universal Work Queue. The vulnerability's impact extends beyond this product, potentially affecting other Oracle products (scope change). The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others and strongly recommends immediate patching. No explicit patch version or remediation level is provided in the advisory content, but Oracle emphasizes applying the Critical Security Patch Update without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, though these may affect functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Universal Work Queue, leading to complete takeover of the product. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond Universal Work Queue. The CVSS score of 9.9 reflects critical impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported as of the advisory date.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or access to relevant packages from users who do not need them. These mitigations may disrupt application functionality, so patching is the preferred and definitive remediation. Patch status is not explicitly confirmed in the advisory content; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.