CVE-2026-60701
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Oracle Universal Work Queue (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, there is a difficult-to-exploit vulnerability. A high-privileged attacker with network access via HTTP can take over the system.
Risk Assessment
The organization may lose full control of Oracle Universal Work Queue, potentially leading to compromise of confidentiality, integrity, and availability of data.
Recommendation
Immediately apply patches provided by Oracle. Restrict network access to the system and review user privileges.
Other vulnerabilities in Oracle Universal Work Queue
See all- CVE-2017-10332High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data accessible in Oracle Universal Work Queue.
- CVE-2017-3417High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3416High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.
- CVE-2017-3415High
Vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.
- CVE-2026-46964Critical
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products.
- CVE-2026-46963Critical
A vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products, changing the scope of the threat.
- CVE-2026-46824Critical
Vulnerability in Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw, leading to takeover of Oracle Universal Work Queue and potentially impacting additional products (scope change).
- CVE-2026-60997High
Vulnerability in Oracle Universal Work Queue (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60700High
Vulnerability in Oracle Universal Work Queue (UWQ Server Issues component) versions 12.2.3-12.2.15. An unauthenticated attacker via HTTP can exploit it, but user interaction is required. Successful attack allows unauthorized creation, deletion, or modification of critical data and access to it.
- CVE-2026-46965High
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite, affecting Work Provider Site Level Administration. Supported versions 12.2.3-12.2.15 are easily exploitable by a low privileged attacker with network access via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).