Oracle Universal Work Queue CVE-2026-60997

The attacker must have network access to the Oracle E-Business Suite web tier over HTTP and must already hold a valid low-privilege EBS/Universal Work Queue account (CVSS PR:L - this is authenticated, not fully anonymous, exploitation). The target must be running Oracle Universal Work Queue on EBS release 12.2.3 through 12.2.15, with the affected 'Non-Media Integration issues' functionality reachable. Limiting factors that reduce real-world risk: valid application credentials are required, and exposure is greatest where the EBS web tier is internet-facing rather than restricted to internal networks; no user interaction and no elevated privileges are needed once a low-privilege account is held, which raises risk for organizations with many EBS users.

The CVSS 3.1 signals point to a genuinely exploitable, high-impact flaw: network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and only low privileges required (PR:L), yielding an 8.1 base score with high confidentiality and integrity loss and no availability impact. Oracle itself describes it as 'easily exploitable,' which aligns with AC:L. However, several corroborating signals are absent: no EPSS score, no CISA KEV listing, and no public POC were provided, so real-world exploitation probability cannot be quantified and should currently be treated as unproven but plausible. There is a notable tension between the 'Authentication Bypass' tag and the CVSS PR:L (which requires the attacker to already hold a valid low-privilege account); this may mean the bypass is of authorization boundaries rather than of authentication entirely - verify with Oracle's advisory. Given EBS's role as a system-of-record for financial and HR data, treat this as a high-priority patch despite the missing exploitation telemetry.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite account (for example, a limited internal user or a compromised service account) sends crafted HTTP requests to the Universal Work Queue Non-Media Integration functions. Exploiting the missing authorization check, they read, alter, or delete critical business data across all data the UWQ application can access, without needing any user interaction or higher privileges. No public exploit code has been identified, so this scenario is derived from the CVSS vector rather than an observed in-the-wild attack.