EUVD-2026-106235
GHSA-f82p-whpf-gvqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS web tier over HTTP
-
DeliverySend crafted request to Workflow Events
-
ExploitBypass authentication boundary
-
ExecutionRead critical Shipping Execution data
-
ImpactExfiltrate confidential records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle E-Business Suite instance running the Oracle Shipping Execution product, specifically reaching the Workflow Events component, on supported versions 12.2.3 through 12.2.15. No authentication, no user interaction, and no non-default configuration are required per the CVSS vector (PR:N/UI:N/AC:L), so any reachable affected instance is exposed. The primary limiting factor is network exposure of the EBS web tier: instances restricted to internal networks or placed behind access controls/VPN substantially reduce reachability, and versions outside 12.2.3-12.2.15 are not listed as affected. |
| Impact | Oracle-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, yielding high confidentiality impact but no integrity or availability impact - i.e. a pure data-disclosure issue. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (an unauthenticated network data-read flaw), so this is not a case of CVSS overstating real risk; however, the only reference is the Oracle October 2026 Critical Patch Update landing page plus an NVD mirror, with no technical write-up, no CWE, and no independent exploitation evidence. Net: a genuinely high-priority patch for any internet- or intranet-exposed Oracle E-Business Suite / Shipping Execution instance because it is unauthenticated and automatable in principle, but the absence of EPSS/KEV/POC data means there is currently no evidence of active or widespread exploitation - prioritize based on exposure of the affected EBS tier rather than on confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the Oracle E-Business Suite web tier sends a crafted HTTP request to the Workflow Events component of Oracle Shipping Execution and retrieves sensitive application data without logging in. Because CVSS is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is needed. No public proof-of-concept is currently referenced, so an attacker would need to develop the request independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to Oracle E-Business Suite 12.2.3 through 12.2.15; the supplied data confirms patch availability through that advisory but does not specify an exact one-off patch or patched build number, so follow Oracle's CPU instructions for the affected EBS release. Until patching is complete, restrict HTTP access to the EBS web tier and Workflow Events endpoints to trusted networks, VPN users, or reverse-proxy allowlists, recognizing that this can break legitimate external integrations and partner access. Monitor EBS web-tier logs for anomalous unauthenticated requests to Shipping Execution/Workflow Events; logging alone does not prevent exploitation but supports detection and response. Prioritize internet-facing or broadly reachable EBS instances because no public exploit code or CISA KEV entry was identified at time of analysis, making exposure and data sensitivity the main risk drivers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite's Shipping Execution product exposes Workflow Events functionality over HTTP. The supplied tags label this as an authentication bypass, which is consistent with the CVSS vector's PR:N/UI:N values: an unauthenticated network attacker can reach the Workflow Events component without user interaction and obtain data accessible to Shipping Execution. No CWE is assigned in the supplied data, and Oracle does not publish detailed root-cause information, so the exact access-control defect is not confirmed; the assessed impact is confidentiality-only. Affected supported releases are 12.2.3 through 12.2.15, and the primary exposure factor is network reachability of the EBS web tier running the affected component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated HTTP access with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H and I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a high-severity, unauthenticated network flaw in the Workflow Events component that can expose critical Shipping Execution data, so organizations with internet-reachable EBS web tiers face potential confidentiality loss. Leadership should prioritize exposure reduction because shipping records can reveal sensitive customer, logistics, and commercial information; No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis mean risk is currently managed through containment rather than patching.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations include restricting network access to the EBS web tier via firewall, VPN, or allowlists; deploying WAF rules for Workflow Events HTTP traffic; enabling enhanced logging and monitoring of Shipping Execution data access; and segmenting the affected component from untrusted networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB