The vulnerability in Oracle Shipping Execution's Workflow Events component permits an unauthenticated attacker to make HTTP requests that bypass authentication controls, enabling compromise of the application and unauthorized access to sensitive data. The bug arises from missing or improperly enforced access controls, classified under CWE‑284. Successful exploitation can expose critical shipping and financial information to the attacker.

Oracle Shipping Execution product of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. Attackers could target the public interfaces of this component without prior authentication.

The CVSS 3.1 base score of 7.5 indicates high confidentiality impact with a user-friendly attack vector. EPSS is not available, and the vulnerability is not yet in CISA's KEV list, but the ease of exploitation via plain HTTP and lack of authentication makes a real-world attack plausible. An attacker can reach the vulnerable code using any open HTTP port, so remote, network-based attacks are viable. Given the unchanged security posture, the risk remains significant, especially for systems exposed to the public Internet.