CVE-2026-46965: Oracle Universal Work Queue Privilege Escalation (CVSS 8.8)

Technical summary

CVE-2026-46965 is an insecure access control vulnerability (CWE-284, CWE-306) in the Work Provider Site Level Administration component of Oracle Universal Work Queue versions 12.2.3 through 12.2.15. The vulnerability stems from improper privilege enforcement over HTTP network endpoints. A low-privileged authenticated attacker can bypass authorization checks via direct network requests, achieving unauthenticated privilege escalation to full administrative control. The attack has no attack complexity; it requires only valid (low-privilege) credentials and network access to the affected service.

Business impact

Compromise of Oracle Universal Work Queue undermines the integrity of work distribution and task management across the entire E-Business Suite environment. An attacker with administrative access can reassign critical business processes, exfiltrate sensitive transaction data, inject malicious work items, or disable the queuing system entirely. For organizations relying on Universal Work Queue for supply chain, finance, or order management, this represents a direct threat to operational continuity and regulatory compliance (PCI-DSS, SOX, GDPR if customer or financial data is processed).

Affected systems

Oracle E-Business Suite installations running Oracle Universal Work Queue versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14, or 12.2.15 are vulnerable. The vulnerability is present in the Work Provider Site Level Administration interface. Systems must be internet-facing or accessible to low-privileged internal users for practical exploitation.

Exploitability

This vulnerability is easily exploitable and requires minimal sophistication. An attacker needs: (1) network access to the Work Queue HTTP endpoint, (2) valid low-privilege credentials (e.g., a standard Oracle E-Business Suite user account), and (3) knowledge of the vulnerable administrative endpoint. No user interaction, social engineering, or complex payload construction is necessary. The low attack complexity and low privilege requirement make this a high-risk vector for insider threats and lateral movement within E-Business Suite environments.

Remediation

Apply the security patches released by Oracle for Universal Work Queue (verify specific patch numbers in your Oracle support portal against your current version). Interim mitigation includes: restricting network access to the Work Queue administration interface via firewall rules and application-level access controls; disabling or deactivating unnecessary low-privileged user accounts; enforcing multi-factor authentication for any user accessing Work Queue administration functions; and monitoring HTTP requests to administrative endpoints for suspicious activity.

Patch guidance

Contact Oracle Support and identify the patch release corresponding to your Universal Work Queue version (12.2.x). Patches are typically released as cumulative updates or critical patch updates (CPU). Schedule patching during a maintenance window with appropriate rollback procedures. Before deploying patches to production, test in a non-production environment matching your configuration. Verify that the patch successfully closes access to the vulnerable Work Provider Site Level Administration endpoints and review Oracle's release notes for any prerequisite changes or post-patch configuration steps.

Detection guidance

Monitor Web Application Firewall (WAF) and HTTP access logs for: (1) requests to Work Queue administration endpoints originating from low-privilege user accounts, (2) unusual HTTP methods (PUT, DELETE, POST) to administrative URLs, (3) repeated failed authentication attempts followed by successful authentication, (4) account takeover indicators (e.g., administrative actions by low-privilege accounts), and (5) large volumes of data exfiltration from Work Queue databases. Enable Oracle E-Business Suite audit logs for the Work Provider Site Level Administration module and review for privilege escalation events. Consider deploying User and Entity Behavior Analytics (UEBA) to detect anomalous access patterns.

Why prioritize this

This vulnerability combines a HIGH CVSS score (8.8) with easily exploitable characteristics and minimal attack friction. Low-privileged users are common in large E-Business Suite installations, and network access is straightforward for internal attackers or compromised low-level accounts. The impact encompasses confidentiality, integrity, and availability—directly affecting business-critical work distribution. Organizations should treat this as a priority-one remediation target, particularly if Universal Work Queue handles payment processing, procurement, or fulfillment workflows.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector (AV:N) increasing exposure, (2) Low attack complexity (AC:L) reducing the barrier to exploitation, (3) Low privilege requirement (PR:L) meaning ordinary users can attack, (4) No user interaction required (UI:N), (5) Impact on confidentiality, integrity, and availability all rated as High (C:H/I:H/A:H). The score does not account for real-world context (e.g., relative scarcity of low-privilege credentials in air-gapped networks), but within the scope of networked E-Business Suite deployments, an 8.8 rating is justified and aligns with the critical nature of this control bypass.

Frequently asked questions