EUVD-2026-106287
GHSA-q3c4-jp4v-8p88
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuinely serious but not top-tier emergency issue. The CVSS 3.1 base score of 7.4 is driven by network attack vector (AV:N) over Oracle Net, no required privileges (PR:N), no user interaction (UI:N), and High confidentiality and integrity impact (C:H/I:H) - meaning an unauthenticated remote attacker could read, create, delete, or modify critical Oracle Shipping Execution data. The key mitigating signal is High attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit,' indicating conditions beyond the attacker's direct control (e.g., specific state, timing, or configuration) must align. There is NO availability impact (A:N) and NO scope change (S:U). Critically, several real-world exploitation signals are MISSING from the input: no EPSS probability is provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no evidence of active exploitation or weaponization. The contrast is clear: the vulnerability is structurally dangerous (unauthenticated data compromise) yet practically harder to exploit and currently shows no exploitation-in-the-wild indicators. Given Oracle E-Business Suite's history of being targeted and the unauthenticated nature, this warrants prompt patching in the October 2026 CPU cycle, but the AC:H rating and absence of KEV/POC/EPSS data place it below drop-everything zero-day priority. One data note: the input Tags include 'Authentication Bypass,' but the description describes an unauthenticated flaw (no credentials required), not a bypass of an authentication control - this label appears imprecise and should be verified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to bring Oracle E-Business Suite 12.2.3-12.2.15 up to the patched release level; the advisory does not enumerate a single fixed version number beyond the CPU, so confirm the target patch level with Oracle Support before rollout. Patch status is 'Patch available per vendor advisory.' If patching must be deferred, the most effective compensating control is to restrict network reachability to the Oracle Net listener, typically TCP 1521, so that only known EBS application-tier and concurrent-manager hosts can connect; the trade-off is that an overly tight ACL breaks legitimate application and batch connectivity, so validate against a full connection inventory first. Restricting or disabling workflow event subscriptions that handle shipping transactions reduces the attack surface but will suppress legitimate shipping notifications and workflow-driven business processes, so scope it to non-production or tightly monitored periods. Because the vector specifies AC:H, exploitation depends on specific conditions, but internet-facing or broadly reachable listeners should still be prioritized for patching given the unauthenticated nature and the high confidentiality and integrity impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Shipping Execution is a logistics and order-fulfillment module inside Oracle E-Business Suite, and the vulnerable component is Workflow Events, the business-event and notification subsystem built on Oracle Workflow. Unlike most EBS modules reached over HTTP, this attack path uses Oracle Net (SQL*Net), the database listener protocol that EBS application tiers use to talk to the database, so the exposure is tied to whatever network positions can reach the Oracle Net listener (commonly TCP 1521) rather than to the web front end. The supplied vendor and EUVD tags classify the issue as an authentication bypass, meaning workflow event handling does not properly enforce the caller's identity or authorization before performing privileged operations on shipping data. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, unauthenticated attack with no user interaction that requires substantial reconnaissance or a narrow timing/configuration condition to succeed. No CWE identifier was supplied, but the behavior maps to the improper-access-control / authentication-bypass class rather than memory corruption or injection. No CPE URIs were provided, so scoping relies on the vendor's version statement and the EUVD affected-version range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
A high-severity flaw in Oracle E-Business Suite's Shipping Execution module, affecting versions 12.2.3 through 12.2.15, could allow network-based attackers to read and alter critical shipping records, undermining order-fulfillment integrity, supply-chain data trust, and related financial or compliance reporting. No vendor-released patch was identified at time of analysis and no public exploit was identified at time of analysis, but leadership should prioritize this because shipping data supports revenue operations, customer commitments, and audit obligations.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Shipping Execution and Workflow Events components, segmenting affected Oracle E-Business Suite 12.2.3 through 12.2.15 instances, monitoring and alerting on shipping-data changes, enforcing least privilege, deploying web application firewall or virtual patching controls if available, and engaging Oracle support for mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB