CVE-2026-46966: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration)

Synopsis

An authentication-partial, network-exploitable vulnerability exists in the Work Provider Site Level Administration component of Oracle Universal Work Queue, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. An attacker with a low-privileged account and HTTP network access can exploit this under specific conditions to fully compromise the affected system. Successful exploitation results in complete loss of confidentiality, integrity, and availability, effectively a full takeover of the Oracle Universal Work Queue instance. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Universal Work Queue service over the network via HTTP; no local or physical access pathway is described.

• AuthenticationRequired

  A low-privileged account is sufficient, but the attacker must hold valid credentials before the attack can proceed.

• Victim interactionNot required

  No user interaction is needed; the attacker can carry out the exploit without involving any other party.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the attacker must meet specific environmental conditions or timing constraints beyond basic network access to trigger the vulnerability reliably.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Universal Work Queue application, including work item records, user data, and configuration secrets.
• The attacker can modify or delete persisted work queue data, assignments, and site-level administration settings.
• The attacker can crash or render the Oracle Universal Work Queue service unavailable, disrupting any business processes that depend on it.
• The combination of full confidentiality, integrity, and availability impact constitutes a complete takeover of the affected Oracle Universal Work Queue instance.