This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, but successful exploitation requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Universal Work Queue. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is classified under CWE-284 (Improper Access Control). No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle strongly recommends applying Critical Patch Updates promptly. The vendor advisory URL is https://www.oracle.com/security-alerts/cpujul2026.html.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Universal Work Queue, as well as unauthorized access to all data accessible by the product. This compromises data confidentiality and integrity. There is no reported impact on system availability. The vulnerability requires user interaction from a person other than the attacker, which is a limiting factor for exploitation.

Oracle has not explicitly stated a specific patch or remediation level for this vulnerability in the advisory. However, it is included in the July 2026 Critical Patch Update, which contains numerous security patches. Oracle strongly recommends that customers apply the latest Critical Patch Updates without delay and remain on actively supported versions. Users should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until patches are applied, organizations should be aware that exploitation requires user interaction and network access via HTTP.