This vulnerability allows an attacker with low privileges and network access via HTTP to compromise the Oracle Universal Work Queue. Exploitation can lead to full takeover of the Work Provider Site Level Administration component, resulting in complete loss of confidentiality, integrity, and availability. The CVSS score of 9.9 indicates a severe security impact, as reflected in the vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Oracle Universal Work Queue for Oracle E-Business Suite is affected. Supported versions from 12.2.3 through 12.2.15 are vulnerable. The issue resides in the Work Provider Site Level Administration component. If your environment runs any of these versions, it is impacted.

The EPSS score of <1% denotes a very low probability of exploitation in the wild, but the risk is still significant due to the high severity. The vulnerability is not listed in CISA KEV, so there are no known public exploit kits available yet. The likely attack vector is network-based via HTTP, and an attacker only needs low privileges to initiate the attack.