Oracle Universal Work Queue CVE-2026-60701

Exploitation requires: (1) network access to the Oracle Universal Work Queue instance over HTTP - the component must be reachable from the attacker's network position; (2) high-level administrative privileges within Oracle E-Business Suite - the attacker must authenticate with an account holding elevated (PR:H) EBS permissions; (3) high attack complexity conditions (AC:H) - the vulnerability is not reliably triggered on demand and likely requires specific configuration states, race conditions, or multi-step preconditions in the Work Provider Site Level Administration component. Exploitation is limited by the combination of required admin-level credentials AND high complexity, making automated or opportunistic exploitation highly unlikely. The attack does not require user interaction (UI:N), meaning once the conditions are met, no victim action is needed. Scope is unchanged (S:U), so the compromise is contained to Oracle Universal Work Queue itself.

The vendor-supplied CVSS 3.1 score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a tension between devastating impact (full C/I/A) and demanding exploitation prerequisites (high complexity, high privileges). Real-world risk is substantially lower than the impact metrics alone suggest: an attacker must already possess high-level administrative credentials within the Oracle EBS environment AND overcome high attack complexity conditions - likely specific timing, configuration states, or multi-step preconditions. EPSS data is not available in the provided intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code has been identified. The 'Information Disclosure' tag conflicts slightly with the 'takeover' description - this may indicate the initial vector involves information leakage that enables escalation to full control, or the tag may be a partial/legacy classification. SSVC assessment: Exploitation status is 'none/public'; automatable is 'no' (AC:H); technical impact is 'total' - suggesting low urgency for most organizations with properly segmented EBS admin access, but high urgency for environments where privileged EBS accounts may be shared, over-provisioned, or exposed.

An attacker who has compromised or obtained high-level Oracle EBS administrative credentials - through phishing, credential reuse, or insider access - sends a specially crafted HTTP request to the Work Provider Site Level Administration component. Under the specific conditions that satisfy the high attack complexity requirement (exact configuration state, timing, or multi-step interaction), the request bypasses authorization controls, resulting in full takeover of the Oracle Universal Work Queue system including unauthorized data access, data manipulation, and service disruption. No public proof-of-concept has been identified, making opportunistic exploitation unlikely without substantial attacker research investment.