What is the CVSS score of CVE-2026-46964?

CVE-2026-46964 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Universal Work Queue are affected by CVE-2026-46964?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical privilege escalation flaw in the Universal Work Queue component that allows authenticated low-privileged remote attackers to…

How to fix or mitigate CVE-2026-46964?

24 hours: Identify all systems running Oracle E-Business Suite 12.2.3-12.2.15 and immediately restrict network access to Work Provider Site Level Administration interfaces using firewall rules limiting to administrative IP ranges. 7 days: Implement privileged access management (PAM) controls, enable detailed audit logging on administrator activities, and register with Oracle support for patch notification. 30 days: Apply vendor patch immediately upon release and validate remediation across all affected instances.

Oracle Universal Work Queue CVE-2026-46964

EUVD-2026-37275 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Universal Work Queue Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable EBS HTTP endpoint, low complexity, requires a low-privileged EBS account (PR:L), no user interaction, scope change to other EBS products, full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full takeover of Oracle Universal Work Queue (component: Work Provider Site Level Administration) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker over HTTP to compromise the application with scope change extending impact to additional products. The CVSS 3.1 base score is 9.9 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle Universal Work Queue is a component of the Oracle E-Business Suite that distributes and manages work items across CRM and back-office applications, exposed via HTTP through the E-Business Suite middle tier. The affected component, Work Provider Site Level Administration, governs how work providers are registered and configured at the site level, and a flaw there can be reached by any authenticated EBS user with network access. CWE is not assigned by NVD, but the CVSS scope change (S:C) and full triad impact, combined with Oracle's pattern of EBS HTTP-tier flaws, point to an authorization or input-handling weakness in a site-administration servlet/endpoint that crosses trust boundaries into other EBS modules.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update - June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to every EBS 12.2.3-12.2.15 environment running Universal Work Queue; Oracle does not publish per-CVE point versions, so apply the CPU bundle rather than waiting for an isolated hotfix. Until the CPU is applied, restrict network access to the EBS middle tier so that the Universal Work Queue HTTP endpoints (notably Work Provider Site Level Administration servlets/JSPs) are reachable only from trusted internal networks via VPN or reverse-proxy ACLs, and tighten EBS responsibilities so that ordinary users do not hold any Universal Work Queue or Site-Level Administration responsibilities (trade-off: legitimate work-queue users lose access until patched). Enable and monitor EBS FND audit logs and web-tier access logs for unexpected POSTs to Universal Work Queue admin URLs as a detective control.