What is the CVSS score of EUVD-2026-37276?

EUVD-2026-37276 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Universal Work Queue are affected by EUVD-2026-37276?

A high-severity account takeover vulnerability in Oracle E-Business Suite 12.2.3-12.2.15 Work Queue administration allows any low-privilege user with network access to gain administrative control,…

How to fix or mitigate EUVD-2026-37276?

24 hours: Conduct inventory of all Oracle E-Business Suite deployments; identify systems running versions 12.2.3 through 12.2.15 and document current low-privilege user access. 7 days: Restrict HTTP/network access to Work Provider Site Level Administration to administrative VPN/bastion hosts only; enable logging of all administrative authentication attempts and actions. 30 days: Monitor Oracle security advisories for patch release; prepare upgrade plan to version 12.2.16+ once available; conduct comprehensive audit of E-Business Suite security controls.

Oracle Universal Work Queue EUVD-2026-37276

| CVE-2026-46965 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Universal Work Queue Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable EBS HTTP endpoint, low complexity, requires an authenticated low-privileged EBS account (PR:L), no user interaction, and full component takeover yields C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Universal Work Queue (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the Work Provider Site Level Administration component. Oracle rates this as easily exploitable with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8), though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Universal Work Queue (UWQ) is a component of Oracle E-Business Suite that distributes and prioritizes work items across call-center, service, and operational users; the affected subcomponent, Work Provider Site Level Administration, governs how work providers are registered and configured per site. The CPE 'cpe:2.3:a:oracle_corporation:oracle_universal_work_queue' narrows exposure to deployments running EBS 12.2.x with UWQ enabled. No CWE is assigned, but the CVSS vector (network, low complexity, low privileges, no user interaction, scope unchanged, high CIA) combined with the 'takeover of Oracle Universal Work Queue' wording is consistent with a broken-access-control or authorization-bypass issue within authenticated EBS HTTP endpoints rather than a memory-corruption flaw.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle E-Business Suite 12.2.3-12.2.15; exact patch numbers are listed in the CPU advisory matrix for the Universal Work Queue component and should be applied via Oracle's standard EBS patching workflow (adop / adpatch) after a test-environment cycle. If immediate patching is not feasible, compensating controls include restricting network access to the EBS HTTP front-end (Oracle HTTP Server / mod_wl) so that only trusted user populations can reach UWQ endpoints, tightening URL firewall (FND: URL allowlists) to exclude UWQ Work Provider Site Level Administration paths for users that do not require them, and auditing and removing unnecessary low-privileged EBS accounts; note that URL allowlist changes can break legitimate workflows for agents who depend on UWQ and should be validated against functional usage before enforcement.