Oracle E-Business Suite CVE-2026-46824: Brief Summary of a 9.9 CVSS Universal Work Queue Takeover

Introduction

A single low-privileged user account on an Oracle E-Business Suite instance can now be turned into a complete application takeover, and the blast radius extends past the compromised component into other interconnected EBS modules. This is CVE-2026-46824, a CVSS 9.9 vulnerability in Oracle Universal Work Queue's Work Provider Site Level Administration, disclosed in the May 2026 Critical Security Patch Update.

Oracle Universal Work Queue (UWQ) is a component within Oracle E-Business Suite that routes service requests, tasks, and work assignments to appropriate agents across multiple EBS modules. Because UWQ sits between modules as an integration layer, the vulnerability's "Scope Changed" designation carries real weight. A compromise of UWQ does not stay inside UWQ. As of 2026, approximately 6,828 verified companies run Oracle E-Business Suite, roughly 4 to 5% of the global ERP market, with deployments ranging from small businesses to large enterprises across industries.

Technical Information

Vulnerability Overview

CVE-2026-46824 affects the Work Provider Site Level Administration component of Oracle Universal Work Queue within Oracle E-Business Suite. NVD published it on May 28, 2026, and lists [email protected] as the source. No CWE classification had been assigned at the time of publication, which makes automated classification harder and limits correlation with known attack patterns.

CVSS 3.1 Vector Analysis

The full CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, for a base score of 9.9. Each metric breaks down as follows:

Scope Changed is what sets this vulnerability apart. Oracle Universal Work Queue integrates with multiple E-Business Suite modules to route service requests, tasks, and assignments to appropriate agents, so a compromise in UWQ can propagate to the components it connects to. The Work Provider Site Level Administration functions control the Work Providers List tab and the administrative functions for work providers at the site level, which makes them a high-value target within the UWQ architecture.

Attack Flow

Based on the CVSS metrics and product documentation, the exploitation path runs in this order:

1. The attacker obtains valid low-privilege credentials for the Oracle E-Business Suite instance. An administrative account is not needed. A standard user account with basic application access is enough.

2. The attacker reaches the EBS application tier endpoints over HTTP. Internet-facing EBS deployments are at highest risk, though access from the internal network also qualifies.

3. The attacker targets the Work Provider Site Level Administration functions within UWQ. This responsibility controls work provider configurations at the site level.

4. Because attack complexity is Low and no user interaction is required, exploitation is straightforward. It needs no race conditions, specialized tooling, or social engineering.

5. Because of the Scope Changed designation, the initial UWQ compromise extends to additional EBS products. The High ratings for confidentiality, integrity, and availability translate to complete data disclosure, arbitrary data modification, and potential system shutdown.

Comparison with Prior UWQ Vulnerability

A prior vulnerability in Oracle Universal Work Queue, CVE-2025-50107, was fixed in the July 2025 CPU. CVE-2026-46824 is a significant escalation from it:

CVE-2025-50107 needed no authentication, but it required user interaction and had limited impact. CVE-2026-46824 requires a low-privilege login, needs no user interaction, and delivers complete takeover with scope change. In operational terms, CVE-2026-46824 is far more dangerous.

What We Do Not Know

Several technical details remain undisclosed:

• No CWE ID has been assigned.
• The specific vulnerable code path has not been published.
• No proof-of-concept exploit code is publicly available.
• The exact mechanism by which the scope change propagates to additional products has not been detailed.

Oracle's standard practice is to withhold exploitation details until a majority of customers have applied the patch.

Affected Systems and Versions

Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected. That range spans over 12 minor releases and covers the large majority of the currently supported EBS 12.2 installed base. Any organization running Oracle Universal Work Queue on a version within this range is vulnerable.

The May 2026 Critical Security Patch Update contains 12 new security patches for Oracle E-Business Suite in total, and 3 of those vulnerabilities are remotely exploitable without authentication. CVE-2026-46824 carries the highest CVSS score of all 12 EBS patches in this update.

Oracle notes that vulnerabilities in the underlying Oracle Database and Oracle Fusion Middleware components can also affect Oracle E-Business Suite, so patching should cover every layer of the EBS stack.

Vendor Security History

Oracle E-Business Suite has a documented pattern of critical vulnerabilities, several of which have been actively exploited:

The most significant precedent is CVE-2025-61882. The Cl0p ransomware group mass-exploited this Oracle EBS zero day in mid-2025, going after internet-facing EBS deployments for data theft and account compromise. Evidence suggests the attackers chained the zero day with flaws patched in Oracle's July 2025 CPU to run the campaign. Oracle then released an emergency security alert and urged immediate patching.

This history shows that Oracle EBS is an active target for sophisticated threat actors, and that the window between patch release and exploitation can be extremely narrow. Organizations that delayed patching CVE-2025-61882 became Cl0p victims.

As of May 29, 2026, no active exploitation of CVE-2026-46824 has been observed. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities Catalog, and no proof-of-concept code, exploit kits, or threat actor claims targeting this specific CVE have been identified. But the CVE was published only one day ago, and a CVSS score of 9.9, scope change, easy exploitation, and ransomware groups' proven targeting of EBS add up to an elevated risk profile. Threat actors have shown they can acquire low-privilege credentials through phishing and credential stuffing, so the authentication requirement is not a meaningful barrier for motivated adversaries.

Oracle strongly recommends applying the May 2026 Critical Security Patch Update as soon as possible. Oracle has explicitly stated that workarounds such as blocking network protocols or removing privileges are not long-term solutions, because they do not correct the underlying problem. For organizations that cannot patch immediately, temporary measures include:

• Restricting HTTP access to EBS application tier endpoints.
• Minimizing the number of users with access to UWQ Work Provider Site Level Administration.
• Monitoring for unusual activity within UWQ administrative functions.

References

• NVD: CVE-2026-46824
• Oracle Security Critical Patch Update Advisory, May 2026
• Text Form of Oracle CSPU May 2026 Risk Matrices
• Oracle Security Alerts Portal
• Oracle Universal Work Queue Implementation Guide
• NVD: CVE-2025-50107 (Prior UWQ Vulnerability)
• Oracle Security Alert Advisory: CVE-2025-61882
• Halcyon: Cl0p Abuses Oracle E-Business Suite for Account Takeover
• Oligo Security: CVE-2025-61882 Oracle EBS Zero Day Exploited in Cl0p Extortion Campaigns
• Resecurity: CVE-2025-61882 Mass Exploitation
• HIPAA Journal: Cl0p Mass Exploiting Zero Day in Oracle EBS
• Landbase: Companies Using Oracle E-Business Suite in 2026
• CISA Known Exploited Vulnerabilities Catalog