PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3416 Oracle CVE debrief

CVE-2017-3416 is an Oracle Universal Work Queue vulnerability in Oracle E-Business Suite that Oracle and NVD describe as easily exploitable over HTTP by an unauthenticated attacker, with successful attacks requiring human interaction. The reported impact is primarily on confidentiality and integrity, including unauthorized access to critical data and unauthorized update, insert, or delete actions against some accessible data.

Vendor
Oracle
Product
CVE-2017-3416
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Organizations running affected Oracle E-Business Suite releases 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, or 12.2.6 should care most, especially teams responsible for ERP application security, identity/access controls, and user-facing business workflows.

Technical summary

NVD classifies the issue with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating remote reachability, no privileges required, and a user-interaction dependency. The affected component is Oracle Universal Work Queue (User Interface subcomponent). NVD lists the vulnerable CPEs for the affected E-Business Suite versions and does not provide a more specific CWE beyond NVD-CWE-noinfo in the supplied record.

Defensive priority

High. The vulnerability is network reachable, unauthenticated, and affects business-critical Oracle ERP functionality. Even though user interaction is required, the confidentiality and integrity impact is significant enough to prioritize patching and exposure reduction promptly.

Recommended defensive actions

  • Confirm whether any Oracle E-Business Suite deployment includes the affected Universal Work Queue versions listed by NVD.
  • Apply Oracle's January 2017 CPU guidance referenced in the vendor advisory link for remediation guidance and patches.
  • Restrict network exposure to Oracle E-Business Suite interfaces where possible, especially HTTP-accessible paths.
  • Increase monitoring for anomalous user activity and unexpected data modification in Oracle E-Business Suite workflows.
  • Review compensating controls for user interaction paths that can trigger the vulnerable component.
  • Validate patch status across test, staging, and production environments before and after remediation.

Evidence notes

This debrief is based only on the supplied NVD record metadata and linked official/vendor references. The supplied record states publication on 2017-01-27 and modification on 2026-05-13, and it identifies the affected Oracle Universal Work Queue versions, attack vector, CVSS vector, and impact summary. No exploit details or unsupported technical claims were added.

Official resources

Published by NVD and CVE on 2017-01-27T22:59:07.460Z. The supplied NVD record was last modified on 2026-05-13T00:24:29.033Z.