This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical or all accessible data within Oracle Universal Work Queue. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with no required user interaction. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle has published a Critical Patch Update advisory in July 2026 referencing multiple vulnerabilities but does not explicitly confirm a patch or remediation for this specific CVE in the provided advisory content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Universal Work Queue, compromising confidentiality and integrity of data. There is no impact on availability reported. This could allow attackers to manipulate sensitive business data managed by the Oracle Universal Work Queue component.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Universal Work Queue interfaces to trusted users only and monitor for unusual activity related to this component.