Oracle E-Business Suite CVE-2026-46824

Attacker must (1) reach the Oracle E-Business Suite HTTP tier hosting Universal Work Queue, typically the OACore managed server on ports 8000/443 of the EBS application node, and (2) hold a valid low-privileged EBS application session (PR:L) - any authenticated FND_USER will suffice; admin role is not required. The vulnerable surface is specifically the Work Provider Site Level Administration function within Universal Work Queue on EBS 12.2.3 through 12.2.15; installations on EBS releases outside that 12.2.x range or with the UWQ module not deployed are not in scope. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so the principal limiting factor is network reachability to the EBS web tier plus possession of any authenticated EBS account - a bar that is low on internet-exposed EBS portals (iStore, iSupplier, iRecruitment) and effectively trivial on intranet deployments.

Signals are consistently severe: CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means network-reachable, low-complexity, no user interaction, only a basic application account required, and the scope crosses into adjacent EBS products with full CIA impact - Oracle explicitly notes 'takeover of Oracle Universal Work Queue.' EPSS and CISA KEV status are not provided in the input, so exploitation probability cannot be quantified, and no public exploit identified at time of analysis. The 'low privileged' requirement is the main limiter: an attacker must hold some authenticated EBS session, but in practice many EBS deployments expose self-service or partner accounts to the internet, which dramatically lowers that bar. Because Oracle EBS is a recurring target in CISA KEV for prior years' CPU bugs, defenders should treat this as priority-patch even absent confirmed in-the-wild activity. Note: CWE is unassigned and Oracle's advisory traditionally withholds technical detail, so root-cause classification is inferred from the CVSS vector rather than confirmed.

An attacker who has obtained or registered any low-privileged Oracle EBS user account (for example, a self-service or iSupplier login on an internet-facing EBS instance) authenticates and issues a crafted HTTP request to the Universal Work Queue Work Provider Site Level Administration component, abusing the scope-change flaw to escalate impact beyond UWQ and take over data and functions in adjacent EBS modules. No user interaction is required, and CVSS AC:L plus 'Easily exploitable' wording from Oracle implies a single-request or short-sequence exploit path. No public exploit identified at time of analysis.