Oracle E-Business Suite EUVD-2026-37274

Attacker must hold valid low-privileged credentials to the Oracle E-Business Suite instance and be able to reach the Universal Work Queue 'Work Provider Site Level Administration' HTTP endpoint on the EBS application tier; target must be running EBS 12.2.3 through 12.2.15 with the Universal Work Queue component deployed. No user interaction by another user is required (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce realistic risk: the PR:L requirement means fully external unauthenticated attackers cannot directly exploit it without first obtaining or registering an EBS session, and EBS instances that are firewalled to internal networks or behind VPN/SSO substantially shrink the attacker population. Conversely, deployments exposing EBS self-service or iSupplier/iStore to the internet effectively make the low-privilege barrier trivial to clear.

All measurable signals point to high real-world priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is near-worst-case: network-reachable, low complexity, only a low-privileged session needed, no user interaction, and a scope change that can cascade into other EBS modules. Oracle itself classifies it as 'easily exploitable' and worth a 9.9. EPSS, KEV status, and SSVC inputs were not provided in the intelligence bundle, so probability of mass exploitation cannot be quantified - this is unknown rather than confirmed low. No POC is identified at time of analysis. The dominant risk driver is that EBS deployments typically hand out low-privilege application accounts widely (employees, contractors, partner portals), which collapses the PR:L barrier in practice; any organization exposing EBS beyond a tightly trusted user base should treat this as a top-tier patch.

An attacker with any low-privileged Oracle E-Business Suite account - for example, an internal employee with a basic self-service responsibility, or a compromised partner-portal credential - sends a crafted HTTP request to the Work Provider Site Level Administration endpoint and abuses the flaw to take over Oracle Universal Work Queue. Because of the CVSS scope change, the attacker then leverages UWQ's trust relationships to read or modify data in other EBS modules (CRM, Service, Order Management), achieving a full confidentiality, integrity, and availability compromise across linked components. No public exploit is identified at time of analysis, but Oracle's 'easily exploitable' rating and the AC:L/PR:L vector make reliable weaponization plausible once details circulate.