This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP, enabling compromise and takeover of the Oracle Universal Work Queue. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond the immediate product to other Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches. No explicit patch version is stated for this product in the advisory, but Oracle strongly recommends applying the June 2026 CSPU without delay. Mitigation may include blocking network protocols required by the attack and removing unnecessary privileges, though these may affect functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Universal Work Queue, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, the attack may have a scope change, significantly impacting other Oracle products beyond Universal Work Queue.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability along with many others. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users. These mitigations may disrupt application functionality. Customers should remain on actively supported versions and apply security patches promptly. Patch status is not explicitly confirmed for this specific product version in the advisory; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.