CVE-2026-46963: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration)

Synopsis

This is a critical-severity vulnerability in the Work Provider Site Level Administration component of Oracle Universal Work Queue, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw without any victim interaction, and the scope extends beyond the vulnerable component itself. Successful exploitation results in full takeover of Oracle Universal Work Queue, including complete loss of confidentiality, integrity, and availability, with potential impact on additional products in the environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Universal Work Queue service over the network via HTTP - no local or physical access is assumed in the attack scenario.

• AuthenticationRequired

  Any low-privilege account is sufficient - the attacker does not need administrative credentials to trigger this vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit this vulnerability entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads all data accessible to Oracle Universal Work Queue, including queued work items, configuration, and any user or session data stored in or accessible through the component.
• Modifies or destroys persisted work queue data, configuration records, and potentially data in additional connected Oracle E-Business Suite products due to scope change.
• Crashes or degrades the Oracle Universal Work Queue service, disrupting business processes that depend on work routing and queue management.
• Because the CVSS scope is marked as changed, a successful attacker can pivot to compromise additional products beyond the directly vulnerable component within the same environment.