CVE-2026-46824: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration)

Synopsis

A critical-severity vulnerability affects the Work Provider Site Level Administration component of Oracle Universal Work Queue, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the affected instance and can spill over to compromise additional products in the same environment. No fix versions have been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Universal Work Queue HTTP interface over the network; no local or physical access is required.

• AuthenticationRequired

  Any low-privilege account on the application is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental factors are required.

Blast Radius

• A successful attacker achieves full takeover of the Oracle Universal Work Queue instance, reading all stored work-queue data including user assignments and configuration.
• The attacker can modify or delete persisted records, disrupting work routing and queue state across all users of the affected instance.
• The service itself can be crashed or made unavailable, halting work-queue processing for dependent business processes.
• Because the CVSS scope is changed, the attacker's access can extend to additional co-hosted Oracle E-Business Suite products, amplifying the impact beyond the initial compromise point.