Oracle Universal Work Queue CVE-2026-46964

Attacker must (1) reach the Oracle E-Business Suite HTTP middle tier hosting the Universal Work Queue module over the network and (2) hold any valid low-privileged EBS account (PR:L) able to authenticate to the Work Provider Site Level Administration component in EBS 12.2.3-12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any non-default hardening such as IP allowlisting of the EBS web tier, removal of internet-facing self-service modules, or stripping Universal Work Queue responsibilities from generic user roles materially limits exploitation. Versions outside 12.2.3-12.2.15 and deployments where the Universal Work Queue component is not provisioned are not in scope.

All available signals point to this being a real priority for EBS operators: CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - network reachable, low complexity, only low privileges needed, no user interaction, and a scope change meaning impact extends beyond Universal Work Queue itself. EPSS, KEV status, and SSVC decision data were not provided in the input, so exploitation probability and active-exploitation status cannot be quantified here; treat the absence of KEV as 'no active exploitation confirmed' rather than 'safe.' EBS internet-facing deployments are a recurring target for opportunistic attackers after Oracle CPUs drop, so the gap between disclosure and exploitation can be short despite no public POC being identified at time of analysis.

An attacker with any low-privileged EBS account - for example a self-service or supplier-portal user reachable over the internet - sends a crafted HTTP request to the Work Provider Site Level Administration endpoint and abuses the flaw to take over the Universal Work Queue module, then pivots through the scope change to read or modify data in other EBS products such as CRM or HR. No public exploit identified at time of analysis, but the AC:L/PR:L/UI:N profile means weaponization is straightforward once details are reverse-engineered from the June 2026 CPU.