This vulnerability permits an attacker who can reach the Oracle Universal Work Queue over HTTP to compromise the system. The flaw is exploitable by a low‑privileged user and can lead to full takeover of the queue service, affecting confidentiality, integrity, and availability. The CVSS vector indicates confidentiality, integrity, and availability impacts at the scope of the application.

Oracle Universal Work Queue, version 12.2.3 through 12.2.15, component Work Provider Site Level Administration. The attack can be performed by a low‑privileged network user who sends crafted HTTP requests to the exposed Work Queue service.

The overall CVSS score is 7.5, representing high severity. The EPSS score is less than 1%, indicating a low exploitation probability in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack is remote and the impact is complete takeover, it remains a significant risk for exposed network assets. Attackers would need to target an internet‑reachable Oracle Universal Work Queue instance; the lack of high prerequisites makes exploitation plausible if a suitable target is found.