Oracle Shipping Execution in Oracle E‑Business Suite is vulnerable to an easily exploitable flaw that permits a low‑privileged attacker with network access over HTTP to gain unauthorized access to critical data, modify or delete data, and cause a partial denial of service. The vulnerability is classified as CVSS 3.1 base score 7.6, reflecting significant impacts to confidentiality, integrity, and availability.

Affected is the Oracle Shipping Execution component of Oracle E‑Business Suite. Implemented versions 12.2.3 through 12.2.15 are vulnerable. The product is accessed via HTTP and integrated with internal operations workflows.

Based on the description, the likely attack vector is a network connection over HTTP to a publicly reachable endpoint of Oracle Shipping Execution. The CVSS score of 7.6 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers only need network connectivity to a publicly reachable HTTP endpoint and a low‑privileged account, making the condition of exploitation relatively low effort. The risk is therefore moderate to high, especially for environments that expose the Shipping Execution workload or grant broad permissions to non‑admin users.