What is the CVSS score of CVE-2026-60701?

CVE-2026-60701 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Oracle Universal Work Queue CVE-2026-60701

EUVD-2026-47052 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9wxf-c7v8-hxcw

Authentication Bypass Oracle Universal Work Queue

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network access via HTTP confirmed; high complexity and high privileges required per description; full CIA impact per 'takeover' language; scope unchanged.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:55 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.

Technical ContextAI

Oracle Universal Work Queue is a component of Oracle E-Business Suite (Oracle EBS), a large-scale enterprise resource planning platform widely deployed in corporate and government environments. The vulnerability resides specifically in the Work Provider Site Level Administration component, which governs the configuration and management of work routing and queue assignment across business units. The CWE classification is not provided by the source data, preventing precise root-cause categorization; however, given the 'takeover' impact language and the Information Disclosure tag, the flaw likely involves improper authorization enforcement or a privilege escalation pathway within the administration interface exposed over HTTP. Affected CPE covers Oracle EBS versions 12.2.3 through 12.2.15, a broad span of supported releases spanning several years of the 12.2.x maintenance branch.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via My Oracle Support and documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patch version numbers externally, so consult the CPU advisory for the specific patch set applicable to your EBS release within the 12.2.3-12.2.15 range. As a compensating control pending patching, restrict network access to the Work Provider Site Level Administration component at the network perimeter - block HTTP access to the administration endpoint from all hosts except dedicated EBS administration workstations; this reduces the attack surface but does not eliminate the vulnerability since AV:N and PR:H still permit exploitation from authorized admin hosts. Audit and minimize accounts holding high EBS administrative privileges (PR:H requirement), applying least-privilege principles to reduce the pool of credentials that could be leveraged. Note that restricting network access may impact legitimate administrative workflows and should be coordinated with EBS administrators before implementation.