This vulnerability affects the Oracle Universal Work Queue product within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the Oracle Universal Work Queue, potentially resulting in full takeover of the component. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The attack complexity is high, requiring network access and low privileges, with no user interaction needed. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly recommends applying patches promptly. No specific patch version or fix is explicitly stated in the advisory content provided.

Successful exploitation can lead to complete compromise of the Oracle Universal Work Queue component, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected service, potentially disrupting business operations and exposing sensitive data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.