Oracle Shipping Execution CVE-2026-101833

Requires a valid low-privilege authenticated session on Oracle E-Business Suite with network/HTTP reach to the Oracle Shipping Execution module (component: Internal Operations); affected builds are 12.2.3 through 12.2.15. No user interaction and no elevated/admin privileges are needed, and no non-default configuration is called out in the description, so any legitimate low-privilege EBS user able to reach the application over HTTP can attempt exploitation. The principal limiting factor is the authentication requirement (PR:L) - an attacker must first obtain or possess EBS credentials - which constrains purely external, credential-less attackers; network exposure of the EBS web tier to untrusted users further widens or narrows practical reach.

This is a credible mid-to-high priority issue for organizations running Oracle E-Business Suite, but not an emergency based on current signals. The CVSS 3.1 base score is 7.6 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L: network-reachable over HTTP, low attack complexity, and only low privileges required with no user interaction, which makes the vulnerability easy to trigger for any attacker who already holds a valid low-privilege EBS account. The impact is weighted toward confidentiality (C:H - complete read access to Shipping Execution data) with lesser integrity and availability impact (I:L/A:L, partial DoS). However, no EPSS score, no KEV listing, and no public proof-of-concept were provided in the input, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The main caveat is a conflict in the input metadata: the vector requires authentication (PR:L) yet the tags include 'Authentication Bypass,' which is inconsistent with a low-privilege-required flaw - treat the tag as suspect and rely on the CVSS vector, which indicates an authenticated (not bypass) attack. Net: a real patch-this-quarter item for EBS shops, driven by low exploitation complexity and high confidentiality impact, rather than a drop-everything zero-day.

An attacker who holds any low-privilege Oracle E-Business Suite account (for example a limited internal or partner user) sends a crafted HTTP request to the Shipping Execution module's Internal Operations component. Because attack complexity is low and no user interaction is needed, the request yields complete read access to Shipping Execution data and allows limited data modification plus a partial denial of service. No public exploit code was identified at the time of analysis.