What is the CVSS score of CVE-2026-60918?

CVE-2026-60918 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Shipping Execution are affected by CVE-2026-60918?

Oracle E-Business Suite versions 12.2.12-12.2.15 contain a critical vulnerability in the Shipping Execution module enabling full system compromise, including complete read/write access to shipment…

How to fix or mitigate CVE-2026-60918?

Within 24 hours, identify all instances of Oracle E-Business Suite 12.2.12-12.2.15 in production and non-production environments; enumerate high-privilege users with Shipping Execution module access; immediately restrict HTTP network access to the Shipping Execution module to only required systems and implement multi-factor authentication for all high-privilege EBS accounts. Within 7 days, deploy network segmentation to isolate affected EBS systems, enable enhanced audit logging for Shipping Execution transactions, conduct access reviews to remove unnecessary high-privilege grants, and establish alerts on high-privilege login attempts. Within 30 days, complete upgrade to Oracle EBS 12.2.16 or later, or implement vendor-provided compensating controls; deprioritize based on business function (prioritize systems handling customer orders and revenue-critical shipments).

Oracle Shipping Execution CVE-2026-60918

EUVD-2026-47185 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-569f-rxfw-jqr4

Privilege Escalation Oracle Shipping Execution

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachable and low complexity, but the description explicitly requires a high-privileged attacker (PR:H); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:33 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.

Technical ContextAI

Oracle Shipping Execution is a logistics/warehouse management module within the Oracle E-Business Suite (EBS) ERP platform, exposed over HTTP as part of the EBS application tier. The affected 'Internal Operations' component handles internal shipment and fulfillment processing. Oracle CPU advisories generally do not disclose a CWE (listed here as N/A) or root-cause detail; the vector (network HTTP, low complexity, high privileges required, unchanged scope, full C/I/A impact) is consistent with an authenticated logic or access-control flaw in a privileged EBS operation that lets an already-trusted user escalate to full control of the module rather than a pre-auth memory-corruption bug. No CPE strings were supplied in the intelligence; affected products are identified only from the Oracle/EUVD version text.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2.x line rather than as a single renamed version, so identify and apply the specific patch mapped to your installed 12.2.12-12.2.15 release from that advisory (exact patch/version numbers are not enumerated in the provided intelligence and should be taken from the CPU matrix). Because exploitation requires high privileges, the most effective compensating controls until patching are tightening access: rigorously review and reduce the set of EBS accounts holding privileged Shipping Execution / Internal Operations responsibilities, enforce least privilege and strong authentication (MFA) on those accounts, and restrict network access to the EBS application tier and its HTTP endpoints to trusted management networks - trade-off being potential disruption to legitimate integrations or remote operators. Increase auditing/monitoring of privileged Shipping Execution transactions to detect abuse. Do not treat these controls as a permanent substitute for the CPU patch.