This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the product, leading to potential full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has published this issue as part of its June 2026 Critical Security Patch Update advisory. While the advisory does not explicitly confirm patch availability for this specific CVE, it strongly urges customers to apply the June 2026 Critical Security Patch Update, which includes fixes for this and many other vulnerabilities. Mitigations include applying the official patches as soon as possible and, until then, reducing exposure by blocking network protocols used by the attack or removing unnecessary privileges from users, though these mitigations may impact application functionality.

Successful exploitation allows a low privileged attacker with network access via HTTP to fully compromise Oracle Universal Work Queue, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected product, as reflected by the CVSS 3.1 score of 8.8. This can lead to unauthorized data access, modification, and service disruption within Oracle Universal Work Queue.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately, which includes patches addressing this vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users who do not need them. Note that these mitigations may disrupt application functionality. Patch status is not explicitly confirmed in the advisory, but the vendor advisory strongly implies that the June 2026 Critical Security Patch Update contains the fix. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.