Description
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 6.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Shipping Execution, part of Oracle E-Business Suite, lets an attacker with high privileges and network access through HTTP try to take control of the component. The vulnerability can expose, alter, or delete data and disrupt the service, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle Shipping Execution versions 12.2.3 through 12.2.15 are affected. These releases belong to the Internal Operations component of Oracle E-Business Suite and are delivered by Oracle Corporation. The vulnerability exists in the internal operations processing of the Shipping Execution module.

Risk and Exploitability

The CVSS v3.1 base score of 6.6 indicates notable impact, with the attack vector requiring network access, a high attack complexity, high privileges, and no user interaction. Exploitation is considered difficult, yet the availability of the flaw and its high-privilege impact mean organizations running the affected releases should consider it serious. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation to date, but the potential remains if the conditions are met.

Generated by OpenCVE AI on August 24, 2026 at 17:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle’s security advisory for patches or product updates for Oracle Shipping Execution
  • Restrict HTTP access to the Shipping Execution service to trusted internal networks and enforce strong authentication for administrative accounts
  • Enable logging and continuous monitoring of the Shipping Execution application to detect unauthorized access or anomalous behavior

Generated by OpenCVE AI on August 24, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle e-business Suite
CPEs cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:shipping_execution:-:*:*:*:*:*:*:*
Vendors & Products Oracle e-business Suite

Mon, 24 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Title Oracle Shipping Execution High-Privilege Takeover Vulnerability

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title Oracle Shipping Execution High-Privilege Takeover Vulnerability
Weaknesses CWE-264
CWE-285

Fri, 21 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Title High-Privilege Takeover via HTTP in Oracle Shipping Execution
Weaknesses CWE-284

Wed, 19 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title High-Privilege Takeover via HTTP in Oracle Shipping Execution
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle shipping Execution
CPEs cpe:2.3:a:oracle:shipping_execution:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle shipping Execution
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle E-business Suite Shipping Execution
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:23:17.500Z

Reserved: 2026-07-14T14:54:48.734Z

Link: CVE-2026-62475

cve-icon Vulnrichment

Updated: 2026-08-24T15:13:00.340Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:03.297

Modified: 2026-08-31T19:16:55.630

Link: CVE-2026-62475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T18:00:04Z

Weaknesses