Oracle Shipping Execution CVE-2026-60918

Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and to have HTTP network access to the Shipping Execution / Internal Operations application-tier endpoints; no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected deployment must be running a supported EBS release in the 12.2.12-12.2.15 range. The dominant limiting factor is the high-privilege prerequisite, which restricts realistic threat actors to trusted insiders or attackers who have already compromised a privileged EBS account; environments that enforce strict least-privilege on Shipping Execution responsibilities and restrict network reachability of the EBS app tier materially reduce exposure.

Signals are mixed but internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) confirms network reachability over HTTP with low attack complexity but critically requires PR:H - high privileges - which is the single largest mitigating factor and caps the score below the critical range despite full C/I/A impact. No EPSS score, SSVC decision, KEV entry, or POC was provided in the intelligence, so exploitation probability cannot be quantified; the absence of KEV and any exploit reference means this is not confirmed as actively exploited. This is a genuine but not top-tier priority: an attacker must already hold high EBS privileges, so the practical threat model is a malicious or compromised privileged insider/service account rather than mass opportunistic exploitation. A note of caution: the 'Tags' list 'Information Disclosure' while the description and vector indicate full takeover with high integrity and availability impact - the tag understates the impact, so defenders should treat this as a takeover-class issue, not merely disclosure.

A user or service account that already holds high EBS privileges (for example a compromised administrator or over-permissioned integration account) sends crafted HTTP requests to the Shipping Execution Internal Operations endpoints and abuses the flaw to gain full control of the Shipping Execution product, reading and altering shipment data and disrupting availability. Because attack complexity is low, once the privileged foothold exists the takeover is straightforward, but no public POC or exploit code has been identified at time of analysis.