CVE-2026-46965: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration)

Synopsis

An authentication-bypass-level privilege escalation vulnerability exists in the Work Provider Site Level Administration component of Oracle Universal Work Queue, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the affected Oracle Universal Work Queue instance, including complete read, write, and availability impact. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Universal Work Queue service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated user on the system can attempt the attack without needing administrative credentials.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and reproducible without depending on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible to Oracle Universal Work Queue, including stored work items, user session tokens, and site-level configuration.
• The attacker can modify or delete persisted records, reassign work items, and alter site-level administration settings across the affected instance.
• The attacker can crash or otherwise deny availability of the Oracle Universal Work Queue service, disrupting work routing for all users.
• Because the CVSS description characterizes this as a full application takeover, the attacker gains effective control of the application process and its underlying data store.