CVE-2026-60700
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle Universal Work Queue (UWQ Server Issues component) versions 12.2.3-12.2.15. An unauthenticated attacker via HTTP can exploit it, but user interaction is required. Successful attack allows unauthorized creation, deletion, or modification of critical data and access to it.
Risk Assessment
Risk includes breach of confidentiality and integrity of critical organizational data, potentially leading to data leakage or manipulation.
Recommendation
Immediately apply patches provided by Oracle for versions 12.2.3-12.2.15 and restrict HTTP access for unauthenticated users.
Other vulnerabilities in Oracle Universal Work Queue
See all- CVE-2017-10332High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data accessible in Oracle Universal Work Queue.
- CVE-2017-3417High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3416High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.
- CVE-2017-3415High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.
- CVE-2026-46964Critical
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products.
- CVE-2026-46963Critical
A vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products, changing the scope of the threat.
- CVE-2026-46824Critical
Vulnerability in Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw, leading to takeover of Oracle Universal Work Queue and potentially impacting additional products (scope change).
- CVE-2026-60997High
Vulnerability in Oracle Universal Work Queue (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60701Medium
In Oracle Universal Work Queue (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, there is a difficult-to-exploit vulnerability. A high-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-46965High
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite, affecting Work Provider Site Level Administration. Supported versions 12.2.3-12.2.15 are easily exploitable by a low privileged attacker with network access via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: UWQ Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).