A critical flaw in Oracle Universal Work Queue allows an attacker who only has low privileges but network access via HTTP to compromise the system. The exploit can elevate privileges enough to take over the Work Queue, leading to full loss of confidentiality, integrity, and availability for the affected environment. The CVSS 3.1 score of 9.9 reflects the potential for complete takeover.

Oracle Universal Work Queue versions 12.2.3 through 12.2.15 are impacted. The vulnerability resides in the Work Provider Site Level Administration component of Oracle E-Business Suite and implies that an attacker can affect Oracle Universal Work Queue directly and potentially compromise other related products, as the scope is a change.

The vulnerability is highly exploitable: an attacker simply needs network accessibility to the Work Queue service over HTTP and can employ a low-privilege account to trigger the exploit. The EPSS score of 0.00042 indicates a very low probability of exploitation, but the 9.9 severity and lack of KEV listing do not diminish the urgency, as the flaw grants complete control over the affected system. This represents a critical risk that requires immediate remediation.