CVE-2025-50105: Privilege Escalation and Workflow Tampering in Oracle E-Business Suite (Universal Work Queue)

HERMES

HERMES THREAT SCORE & ERP WORKFLOW EXPOSURE

Target: Oracle E-Business Suite 12.2.3 through 12.2.14 (Universal Work Queue)

Confidence: 96%

82 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 17 / 20

Threat Activity 14 / 20

Weaponization 15 / 20

Exposure 16 / 20

Prevalence 18 / 20

Impact 18 / 20

Exploit Maturity 15 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-50105 at an HTS of 82 (HIGH SEVERITY). While requiring a low-privileged account, this access control flaw in Work Provider Administration allows users to create, delete, or manipulate critical ERP workflow queues, creating significant business disruption and financial fraud risks.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-50105: Privilege Escalation and Workflow Tampering in Oracle E-Business Suite (Universal Work Queue)VULNERABILITY

Connected Nodes: 0

Enterprise ERP Workflow Tampering

CVSS v3.1: 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) / CWE-284: Improper Access Control.
Vulnerability in Oracle Universal Work Queue of Oracle E-Business Suite. Low-privileged authenticated users can bypass authorization checks, gain unauthorized access to all accessible work provider data, and alter business-critical approval chains.

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2025-50105	Official NVD / MITRE record
Associated CWE	CWE-284 / CWE-862: Improper Access Control / Missing Authorization	Horizontal and vertical privilege escalation in ERP
CVSS v3.1 Score	8.1 HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0 Score	8.4 HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Applicable CPEs	cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:universal_work_queue:*:*:*:*:*:*:*:*	Enterprise Resource Planning (ERP) platform
Affected Versions	12.2.3 through 12.2.14 inclusive	Enterprise E-Business Suite deployments
Fixed Versions	12.2.14 with July 2025 CPU (Patch 37905886)	Oracle Critical Patch Update July 2025

---

2. Exploitation

• CISA KEV: Not listed in KEV.
• EPSS Score: 0.00350 (Percentile: 28.2%).
• Operational Status: Post-authentication insider or compromised-credential attack vector.
• PoC & Weaponization: Direct HTTP requests manipulating OA Framework state parameters to access WorkProviderAdminPG.
• Access Conditions: Requires low-privileged user account; network access via HTTP/HTTPS (port 8000 or 443); low complexity.

---

3. Threat Intelligence

• Threat Actors: Malicious insiders, compromised employee accounts, financial fraud groups.
• Observed Campaigns: Fraudulent payment approvals and altered procurement workflows.
• Associated Malware: Custom REST/SOAP API attack automation scripts.
• Exploitation Timeline: Fixed by Oracle in the July 2025 Critical Patch Update.

---

4. Detection & Forensic Triage

Indicators of Compromise (IOCs)

• Suspicious HTTP Requests: Unauthorized requests to Work Provider Administration pages from users lacking IEU_ADMIN responsibility.
• Database Alterations: Unexpected modifications in tables IEU_UWQ_SEL_ENUMS and IEU_WP_PARAM_DEFS_B.

Sigma Rule

title: Unauthorized Oracle EBS Universal Work Queue Admin Access (CVE-2025-50105)
id: b2a89c14-5010-4789-9a01-223344556677
status: test
description: Detects unauthorized HTTP access to Oracle EBS Work Provider Administration endpoints
references:
  - https://www.oracle.com/security-alerts/cpujul2025.html
author: Hermes Codex Research
date: 2026-09-10
logsource:
  category: webserver
  definition: Oracle EBS Apache OHS and OACore access logs
detection:
  selection:
    cs_method: 'POST'
    cs_uri_stem|contains: '/OA_HTML/OA.jsp'
    cs_uri_query|contains:
      - 'oracle.apps.ieu.workprovider'
      - 'IEU_WP_ADMIN'
      - 'WorkProviderAdminPG'
  condition: selection
falsepositives:
  - Legitimate ERP system administrators maintaining work queues
level: high

YARA Signature

rule Exploit_Oracle_EBS_UWQ_CVE_2025_50105 {
    meta:
        description = "Detects exploit payloads targeting Universal Work Queue administration"
        author = "Hermes Codex Research"
        date = "2026-09-10"
        reference = "CVE-2025-50105"
    strings:
        $s1 = "oracle.apps.ieu.workprovider" ascii
        $s2 = "IEU_WP_ADMIN" ascii
        $s3 = "updateWorkProvider" ascii
        $s4 = "OA_HTML/OA.jsp" ascii
    condition:
        all of them
}

Suricata / Snort Signature

alert http $EXTERNAL_NET any -> $EBS_SERVERS any (msg:"HERMES - Oracle EBS Universal Work Queue Admin Bypass (CVE-2025-50105)"; flow:to_server,established; content:"POST"; http_method; content:"/OA_HTML/OA.jsp"; http_uri; content:"oracle.apps.ieu.workprovider"; http_client_body; classtype:web-application-attack; sid:202550105; rev:1;)

Logs & Forensic Artifacts

• OACore & OHS Logs: Inspect access_log and oacore_server*.log located in $EBS_DOMAIN_HOME/servers/oacore_server1/logs/.
• Database Fine-Grained Auditing (FGA): Audit logs tracking INSERT/UPDATE operations on APPLSYS tables.
• MITRE ATT&CK: T1078 (Valid Accounts), T1068 (Exploitation for Privilege Escalation), T1565 (Data Manipulation).

---

5. Remediation & Hardening

1. Apply Oracle CPU Patch: Deploy Patch 37905886 using Oracle Online Patching (adop).
2. Execute Full adop Cycle: Complete apply, finalize, cutover, and cleanup phases to ensure updated Java class files are loaded.
3. Audit User Responsibilities: Review all assigned roles and revoke unauthorized access to administrative functions.
4. Enable Fine-Grained Auditing: Configure FGA policies on work queue database tables.
5. Monitor Workflow Approvals: Continuously inspect workflow logs for suspicious reassignments or out-of-order approvals.

---

6. Enterprise Impact Scenario

”What happens if this vulnerability is exploited in an enterprise?”

1. Initial Access via Base User: An attacker with compromised standard employee credentials logs in to the corporate Oracle E-Business Suite instance.
2. Forced Browsing to Work Provider Admin: The user issues crafted HTTP requests targeting /OA_HTML/OA.jsp with oracle.apps.ieu.workprovider parameters, bypassing page-level responsibility checks.
3. Queue Configuration Hijacking: The attacker modifies work provider enumeration rules, rerouting executive approval tickets directly to their own queue.
4. Fraudulent Purchase Approval: The rogue actor approves large fraudulent procurement requests or updates vendor payment banking details.
5. Enterprise Workflow Disruption: By altering critical work provider configurations, normal queue routing is broken across the organization, freezing daily business operations.