This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges. Successful exploitation can lead to full compromise of the Oracle Universal Work Queue, impacting confidentiality, integrity, and availability. The vulnerability is rated with a CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle has published this issue as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. Oracle strongly advises customers to apply these patches without delay to mitigate the risk. Workarounds include blocking network protocols used by the attack or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows a low privileged attacker with network access via HTTP to take over Oracle Universal Work Queue, resulting in high impact on confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data compromise, and disruption of service within Oracle Universal Work Queue.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them. However, these mitigations may impact application functionality. Patch status is confirmed by the vendor advisory; therefore, applying the official patch is the recommended remediation.