Shipping Execution
Monthly
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.
Full takeover of Oracle Shipping Execution (versions 12.2.3-12.2.15) within Oracle E-Business Suite is achievable by a high-privileged, network-based attacker over HTTP when high-complexity conditions are satisfied. Despite requiring elevated privileges and difficult attack conditions, successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively a system takeover of the Shipping Execution module. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update.
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Shipping Execution component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.
Full takeover of Oracle Shipping Execution (versions 12.2.3-12.2.15) within Oracle E-Business Suite is achievable by a high-privileged, network-based attacker over HTTP when high-complexity conditions are satisfied. Despite requiring elevated privileges and difficult attack conditions, successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively a system takeover of the Shipping Execution module. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update.
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Shipping Execution component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.