This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires human interaction from a user other than the attacker. The impact includes unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the Oracle Universal Work Queue. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability is publicly disclosed with no explicit remediation level or patch availability stated in the vendor advisory. The vendor advisory recommends applying security patches promptly but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Universal Work Queue. This compromises confidentiality and integrity of the affected system's data. The vulnerability requires user interaction, which limits automated exploitation but still poses a significant risk due to the high impact on data security.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Universal Work Queue and educate users to be cautious of unsolicited interactions that could trigger exploitation.