This vulnerability is situated in the Workflow Events component of Oracle Shipping Execution, an Oracle E‑Business Suite product. It permits an unauthenticated attacker with network access via HTTP to compromise the application, leading to a full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no user interaction, can be performed remotely, has high attack complexity, and results in complete confidentiality, integrity, and availability loss.

The affected product is Oracle Shipping Execution, part of Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are identified as affected. These versions are supported and can be reached over HTTP by external actors.

The severity is high with a CVSS base score of 8.1. Although EPSS is not available, the lack of a required credential and the availability of an HTTP endpoint suggest a non‑negligible risk of exploitation. The application is listed as not in the CISA KEV catalog, yet the potential for a full takeover makes immediate mitigation prudent. An attacker would need only network connectivity to the service and could achieve remote code execution or complete system compromise without prior authentication.