Universal Work Queue

CVE-2026-60997 Jul 21, 22:18 HIGH This Week

Data compromise in Oracle Universal Work Queue (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read and modify all data the application can access via crafted HTTP requests. The flaw carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

CVE-2026-60700 Jul 21, 22:18 HIGH This Week

Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

CVE-2026-60701 Jul 21, 22:18 MEDIUM This Month

Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.

CVE-2021-35562 Oct 20, 11:16 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-2246 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-14862 Oct 21, 15:15 HIGH This Week

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Internal Operations). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-14855 Oct 21, 15:15 CRITICAL Act Now

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2819 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2818 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-10332 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: Administration). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2017-3417 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3416 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3415 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-0536 Jan 21, 03:01 MEDIUM This Month

Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to error messages. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2016-0525 Jan 21, 03:01 MEDIUM This Month

Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.