The vulnerability exists in the Workflow Events component of Oracle Shipping Execution, part of Oracle E‑Business Suite. An attacker who is not authenticated but has network access via HTTP can compromise the system. Successful exploitation allows the attacker to create, delete, or modify data and to gain full access to all data exposed by Oracle Shipping Execution, resulting in total loss of confidentiality and integrity for that data.

Oracle Shipping Execution (Oracle E‑Business Suite) versions 12.2.3 through 12.2.15 are affected. The flaw is reachable over the network through the standard HTTP interface, so any machine with access to the Oracle Shipping Execution port is potentially vulnerable.

The CVSS v3.1 base score of 7.4 reflects a high‑severity flaw. The attack vector is network (AV:N), the complexity is high (AC:H), and no user interaction is required (UI:N). Because the vulnerability is unauthenticated, an attacker can launch the exploit remotely without credentials. The EPSS score is not available and the vulnerability is not listed in CISA KEV, yet the combination of authentication bypass and privilege escalation makes it a significant risk for unauthorized data manipulation.