The Oracle Shipping Execution product contains a flaw in its Workflow Events component that can be exploited by an unauthenticated attacker who has network connectivity via Oracle Net. By sending a crafted request, the attacker can create, delete or modify critical data or gain complete access to all data accessible by the application. This vulnerability involves improper access control and privilege management, leading to unauthorized information exposure (CWE‑200). The result is a confidentiality and integrity compromise, reflected in a CVSS 3.1 base score of 7.4. The vulnerability is difficult to exploit, but the potential impact is significant.

The affected vendor is Oracle Corporation, specifically the Oracle Shipping Execution component of Oracle E‑Business Suite. Affected software versions range from 12.2.3 to 12.2.15.

The CVSS score of 7.4 indicates a high risk level, and the EPSS score of <1% indicates a very low exploitation probability, yet the vulnerability still poses serious risk. The flaw is not currently listed in CISA’s KEV catalog, but the lack of an authentication requirement and the potential for full data tampering are considerable concerns. An attacker would need network access to Oracle Net and could craft a request to perform the malicious operations, making this a viable threat despite its difficulty to exploit.