Skip to main content
Mallory
Back to vulnerabilities
Medium

Oracle Universal Work Queue Request Handling CSRF in Oracle E-Business Suite

IdentifiersCVE-2025-50107CWE-352

CVE-2025-50107 is an easily exploitable vulnerability in the Request handling component of Oracle Universal Work Queue within Oracle E-Business Suite, affecting supported versions 12.2.5 through 12.2.14. Oracle states the issue is exploitable by an unauthenticated attacker over HTTP and requires human interaction by a victim other than the attacker. The attack can compromise Oracle Universal Work Queue and, because the scope is changed, may significantly affect additional products accessible through the E-Business Suite environment. Based on the attack prerequisites and impact profile provided by Oracle—network-based exploitation, no authentication required, and required victim interaction resulting in unauthorized read and modification of application data—the issue is most consistent with a cross-site request forgery class weakness in request handling.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in unauthorized update, insert, or delete operations against some data accessible through Oracle Universal Work Queue, as well as unauthorized read access to a subset of accessible data. Oracle rates the vulnerability with CVSS 3.1 6.1 and notes confidentiality and integrity impacts with no availability impact. Because the vulnerability has scope change, compromise of Oracle Universal Work Queue may also significantly impact additional connected or reachable products within the Oracle E-Business Suite context.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of Oracle E-Business Suite and Oracle Universal Work Queue over HTTP to untrusted networks, restrict access through network controls, and require access via trusted paths such as VPN or internal segmentation. Because exploitation requires victim interaction, implement anti-CSRF protections where possible, enforce strong session management, and train users to avoid following untrusted links while authenticated to EBS. Monitor EBS access logs and application workflows for suspicious state-changing requests, unexpected data modifications, and anomalous read activity. Review for broader EBS misconfigurations and default settings that could increase exposure.

Remediation

Patch, then assume compromise.

Apply Oracle’s July 2025 Critical Patch Update fixes for Oracle E-Business Suite, specifically the vendor patch addressing CVE-2025-50107 in Oracle Universal Work Queue Request handling. Upgrade or patch affected Oracle E-Business Suite deployments in the supported vulnerable range 12.2.5 through 12.2.14 according to Oracle’s Patch Availability Documents and current vendor guidance. Validate that all internet-exposed or externally reachable EBS instances have received the relevant CPU updates.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
OracleUniversal Work Queueapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence1

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2025-50107
NVD
nvd.nist.gov/vuln/detail/CVE-2025-50107
MITRE CWE · CWE-352
cwe.mitre.org
Patch
oracle.com/security-alerts/cpujul2025.html