This vulnerability in Oracle Universal Work Queue (component: Work Provider Site Level Administration) affects supported versions 12.2.3 through 12.2.15. It is easily exploitable by a low privileged attacker with network access over HTTP, allowing compromise and takeover of the Oracle Universal Work Queue. The vulnerability has a CVSS 3.1 base score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. The vulnerability also has a scope change, potentially impacting additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory addresses this and other vulnerabilities, strongly urging customers to apply patches promptly.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Universal Work Queue, resulting in complete loss of confidentiality, integrity, and availability of the affected component. Due to scope change, other Oracle products may also be significantly impacted by attacks leveraging this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to relevant packages from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory text, so customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.