CVE-2026-46824
Oracle Universal Work Queue Authentication Bypass
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | universal_work_queue | From 12.2.3 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Universal Work Queue component of the Oracle E-Business Suite, specifically in the Work Provider Site Level Administration. It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to exploit the system easily.
Successful exploitation can lead to a complete takeover of the Oracle Universal Work Queue, and because of the scope change, it may also significantly impact additional Oracle products.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a low privileged attacker with network access to compromise Oracle Universal Work Queue, potentially resulting in a complete takeover of the system. Given the high impact on confidentiality, integrity, and availability (CVSS score 9.9), such a compromise could lead to unauthorized access to sensitive data and disruption of services.
This level of impact could negatively affect compliance with common standards and regulations such as GDPR and HIPAA, which require protection of personal and sensitive data, ensuring data integrity, and maintaining availability of critical systems.
However, the provided information does not explicitly mention compliance implications or specific regulatory impacts.
How can this vulnerability impact me? :
The impact of this vulnerability is severe, with a CVSS 3.1 base score of 9.9, indicating critical severity. It affects confidentiality, integrity, and availability.
- An attacker can take over the Oracle Universal Work Queue.
- This takeover can lead to unauthorized access to sensitive data (confidentiality impact).
- It can allow modification or destruction of data or processes (integrity impact).
- It can disrupt the availability of the Oracle Universal Work Queue and potentially other related products (availability impact).