Oracle Shipping Execution CVE-2026-101837

Exploitation targets the Workflow Events component of Oracle Shipping Execution within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable remotely over HTTP. The attacker must hold valid low-privileged credentials to the EBS environment (PR:L - this is not an unauthenticated flaw), and the high attack complexity (AC:H) implies success depends on specific, non-default conditions or precise request crafting rather than a simple single-shot request. The scope change (S:C) means impact can extend beyond Shipping Execution to other integrated E-Business Suite products. Key limiting factors for defenders: a valid authenticated EBS account is required, exploitation is difficult (AC:H), and exposure is reduced where the EBS HTTP interface and Shipping Execution module are not reachable by untrusted or external users.

This is a genuinely elevated but not top-tier emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H, 7.7) tells a consistent story: network-reachable over HTTP, but with high attack complexity and a requirement for low-level authenticated access (PR:L), which materially narrows the attacker pool to those who already hold some valid EBS account. The headline impact is availability (A:H - a complete, repeatable DOS of Oracle Shipping Execution), with only partial confidentiality and integrity impact (C:L/I:L), plus a scope change (S:C) meaning collateral impact to adjacent Oracle E-Business Suite products. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation - this is a low-noise, no-public-exploit issue at time of analysis. The signals do not conflict: high CVSS is driven mainly by the DOS availability impact and scope change, not by ease of exploitation. The combination of AC:H and PR:L suggests a specialized, non-trivial attack by an authenticated user rather than mass, opportunistic exploitation. Treat this as a standard-priority patch within the Oracle quarterly CPU cycle, prioritized higher where untrusted users hold EBS accounts, rather than a drop-everything zero-day. No CWE was supplied, limiting precise weakness classification.

A low-privileged user with a valid Oracle E-Business Suite account sends specially crafted HTTP requests to the Workflow Events component of Oracle Shipping Execution, triggering a condition that hangs or repeatedly crashes the service for a complete denial of service and allows limited unauthorized reads and modifications of Shipping Execution data. Because of the scope change, the disruption may cascade to other integrated E-Business Suite products. The high attack complexity means reliable exploitation requires specific conditions or crafting effort, and no public exploit code was identified at the time of analysis.