CVE-2026-46964: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration)

Synopsis

A critical-severity, remotely exploitable vulnerability exists in the Work Provider Site Level Administration component of Oracle Universal Work Queue, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. An attacker with any low-privilege account and HTTP network access can exploit this flaw without any additional interaction from a victim. Successful exploitation results in a full takeover of Oracle Universal Work Queue, with scope change meaning the impact can spill over into other products sharing the environment. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Universal Work Queue service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but some form of authenticated access to the application is required.

• Victim interactionNot required

  The exploit completes without any action from another user; no social engineering or victim click is needed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access and a low-privilege account.

Blast Radius

• A successful attacker gains full control over Oracle Universal Work Queue, reading all stored work-queue data including task records, user assignments, and configuration details.
• The attacker can modify or delete persisted work-queue rows and administrative configuration, disrupting business-process routing and data integrity.
• The affected service can be crashed or rendered unavailable, halting work distribution across all queues.
• Because the CVSS scope is changed, the attacker can pivot to compromise additional Oracle E-Business Suite products co-hosted in the same environment, extending impact beyond the initial target.