What is the CVSS score of CVE-2026-60700?

CVE-2026-60700 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Universal Work Queue are affected by CVE-2026-60700?

Oracle E-Business Suite's Universal Work Queue component (versions 12.2.3-12.2.15) contains a high-severity data compromise vulnerability allowing unauthenticated attackers to read and modify queue…

How to fix or mitigate CVE-2026-60700?

Within 24 hours: Identify all Oracle EBS 12.2.x deployments and confirm affected version status; send security alert to all EBS users warning against suspicious links and requests to interact with untrusted content, and educate support staff on the attack vector. Within 7 days: Contact Oracle Support to obtain the July 2026 Critical Patch Update (CPUjul2026); schedule maintenance windows and evaluate restricting UWQ access to critical functions as interim risk reduction. Within 30 days: Deploy CPUjul2026 to all vulnerable UWQ servers running versions 12.2.3-12.2.15; validate UWQ functionality is restored and enable detailed server-side logging to detect exploitation attempts.

Universal Work Queue CVE-2026-60700

EUVD-2026-47051 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gmqx-mxqj-4wqc

Authentication Bypass Oracle Universal Work Queue

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:33 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: UWQ Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.