Oracle Universal Work Queue CVE-2026-46965

Attacker must have a valid low-privileged Oracle E-Business Suite account (PR:L) and network reachability to the EBS HTTP/HTTPS front-end hosting the Oracle Universal Work Queue module; the EBS instance must be running version 12.2.3 through 12.2.15 with the UWQ component deployed and its Work Provider Site Level Administration functionality reachable. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the account and HTTP reachability exist, exploitation is direct. Limiting factors: EBS deployments restricted to internal networks or VPN, environments without UWQ enabled, and instances already on a 12.2.x release with the June 2026 CPU applied are not exploitable.

The signals are largely concordant on elevated risk: AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H means any holder of a low-privileged EBS account reachable over HTTP can take over the UWQ component with no user interaction and low attack complexity, which is operationally significant in environments where self-service or low-tier accounts exist. Counter-signals tempering urgency: no EPSS score, KEV listing, or public POC was provided, and the scope is Unchanged (S:U), so impact is bounded to the UWQ component rather than crossing into the broader EBS trust boundary as advertised. The primary uncertainty is the precise definition of 'low privileged' in Oracle's CPU model - Oracle commonly assigns PR:L to any authenticated EBS user, which in many deployments is effectively a large attack surface, so defenders should treat this as a high-priority patch for any internet-exposed or partner-accessible EBS instance and a normal-priority patch for fully internal ones.

An attacker who has obtained or been issued any low-privileged Oracle E-Business Suite account (for example a service-desk agent, contractor, or self-registered user) authenticates to the EBS HTTP interface and sends crafted requests to the Work Provider Site Level Administration endpoints of Universal Work Queue, abusing missing authorization checks to reconfigure or take over the UWQ component. The result is full read, modify, and disrupt control over work-queue routing - allowing the attacker to reroute, suppress, or tamper with work items distributed to operational users. No public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile makes weaponization straightforward once details are reverse-engineered from the CPU patch.