What is the CVSS score of CVE-2026-60997?

CVE-2026-60997 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Universal Work Queue are affected by CVE-2026-60997?

A high-severity vulnerability in Oracle E-Business Suite's Universal Work Queue component (versions 12.2.3-12.2.15) exposes company data to unauthorized access and modification by low-privileged…

How to fix or mitigate CVE-2026-60997?

Within 24 hours, identify all systems running Oracle E-Business Suite 12.2.3-12.2.15 and catalog the sensitive data accessible through Universal Work Queue; assemble an incident response team and investigate whether unauthorized access has already occurred. Within 7 days, deploy network-level access controls (such as Web Application Firewall rules) to restrict crafted HTTP requests targeting the Universal Work Queue component, enable comprehensive audit logging of all data access and modifications, and temporarily disable non-essential Universal Work Queue functionality if operationally feasible. Within 30 days, contact Oracle Support for emergency security updates or accelerated upgrade paths to supported E-Business Suite versions, and conduct a business impact analysis to determine whether migration to a patched version or alternative solution is required, given the absence of a security patch timeline from the vendor.

Oracle Universal Work Queue CVE-2026-60997

EUVD-2026-47231 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9m34-m3q8-3r88

Authentication Bypass Oracle Universal Work Queue

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Authenticated low-privilege EBS user (PR:L) reaches a low-complexity HTTP endpoint (AV:N/AC:L) causing full data read/modify (C:H/I:H) with no availability loss (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Non-Media Integration issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Universal Work Queue (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read and modify all data the application can access via crafted HTTP requests. The flaw carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

Technical ContextAI

Oracle Universal Work Queue (UWQ) is the work-distribution and task-routing engine within Oracle E-Business Suite (EBS), typically fronted by the EBS web tier (Oracle HTTP Server / WebLogic) and reached over HTTP. The affected function is the 'Non-Media Integration issues' component, which handles integration of non-telephony work items into the queue. No CWE was assigned by Oracle, but the supplied 'Authentication Bypass' tag combined with C:H/I:H impact points to a broken access-control or authorization-check weakness (CWE-284/CWE-863 class) that lets an already-authenticated low-privilege user reach or manipulate data outside their intended scope rather than a memory-safety or injection bug. Because the scope is Unchanged (S:U), the impact is confined to data the UWQ application itself can access.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); no standalone fix version number was published in the available data beyond the CPU bundle, so identify and apply the specific EBS 12.2 patch mapped to your release from the CPU patch matrix. Because EBS patching requires downtime and regression testing, interim compensating controls should be considered: restrict network access to the EBS web tier and the Universal Work Queue endpoints to trusted internal networks or VPN only, place the application behind a WAF or reverse proxy to filter anomalous HTTP requests to UWQ integration URLs, and tighten EBS responsibility/role assignments so low-privilege accounts cannot reach Non-Media Integration functions - noting that overly aggressive endpoint restrictions may break legitimate work-queue integrations and should be validated in a test environment first.