Description
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).
Published: 2026-10-20
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The Oracle Shipping Execution product of Oracle E-Business Suite contains a vulnerability in the Workflow Events component that permits an attacker with low privileges and network access via HTTP to cause a repeatable crash, resulting in a complete denial of service, and to perform unauthorized updates, inserts, deletes, and reads of accessible data. The CVSS v3.1 base score is 7.7, reflecting significant impacts on confidentiality, integrity, and availability.

Affected Systems

Oracle Shipping Execution versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The vulnerability is exploitable over the network with a low attack effort and does not require user interaction. The impact is substantial because it can both disrupt service and compromise data. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score and scope change indicate a moderate to high risk that warrants prompt remediation.

Generated by OpenCVE AI on October 21, 2026 at 02:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a non‑affected Oracle Shipping Execution version.
  • Restrict HTTP access to Oracle Shipping Execution to trusted networks or IP ranges to limit exposure.
  • Implement firewall rules or service isolation to block or contain the affected component if patching cannot be performed immediately.

Generated by OpenCVE AI on October 21, 2026 at 02:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Denial of Service in Oracle Shipping Execution Workflow Events
Weaknesses CWE-20
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).
First Time appeared Oracle
Oracle shipping Execution
CPEs cpe:2.3:a:oracle:shipping_execution:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle shipping Execution
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H'}

Subscriptions

Oracle Shipping Execution
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:28:51.859Z

Reserved: 2026-09-28T15:40:09.510Z

Link: CVE-2026-101837

cve-icon Vulnrichment

Updated: 2026-10-27T11:28:36.447Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:39.847

Modified: 2026-10-27T12:16:50.347

Link: CVE-2026-101837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:30:13Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control