{"id":"CVE-2026-101834","kind":"vulnerability","aliases":["CVE-2026-101834"],"related":[],"title":"Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw allows takeover","description":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Shipping Execution in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Workflow Events component. A remote attacker who can reach it over HTTP without logging in can take over the product, per the CVSS 8.1 high-severity rating.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","on-prem","oracle-ebs","shipping-execution","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Oracle E-Business Suite release and whether it falls within 12.2.3 through 12.2.15 (sources do not give a command for this)\n- Confirm whether Shipping Execution is in use and whether its HTTP endpoints are reachable from outside the network: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Shipping Execution in E-Business Suite; the patch version is unknown from the sources\n- Move to a supported E-Business Suite release outside 12.2.3 through 12.2.15: unknown","status":"open","published_at":"2026-10-20T22:18:39+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:06:16+00:00","updated_at":"2026-10-25T03:06:16+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:06:16Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Shipping Execution in E-Business Suite; the patch version is unknown from the sources\n- Move to a supported E-Business Suite release outside 12.2.3 through 12.2.15: unknown","reach":"internet","title":"Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw allows takeover","impact":"high","summary":"Oracle Shipping Execution in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Workflow Events component. A remote attacker who can reach it over HTTP without logging in can take over the product, per the CVSS 8.1 high-severity rating.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","shipping-execution","erp","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over Shipping Execution, affecting confidentiality, integrity and availability","analyst_note":"Find Oracle's Critical Patch Update advisory and the patch number for Shipping Execution Workflow Events; confirm the affected range and whether internet exposure is required.","how_to_check":"- Check the installed Oracle E-Business Suite release and whether it falls within 12.2.3 through 12.2.15 (sources do not give a command for this)\n- Confirm whether Shipping Execution is in use and whether its HTTP endpoints are reachable from outside the network: unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Shipping Execution module in use. The sources do not say which configurations expose the Workflow Events component, so whether internet-facing deployments are more exposed is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":3461,"output_tokens":677,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101834':15A,18A '-2026':14A,17A '/av':143C '12.2.15':41B,98C '12.2.3':39B,97C '3.1':130C,142C '8.1':70B,133C 'access':108C 'affect':95C 'allow':11A,103C 'attack':52B,105C,117C 'avail':137C 'base':131C 'busi':4A,36B,86C 'compon':49B,88C 'compromis':112C 'confidenti':134C 'cve':13A,16A 'cvss':69B,129C,139C,141C 'difficult':99C 'e':3A,35B,85C 'e-busi':2A,34B,84C 'eb':25B 'erp':19B 'event':48B,90C 'execut':7A,28B,32B,80C,115C,128C 'exploit':101C 'flaw':10A,44B 'h':151C 'h/a':150C 'h/i':149C 'h/pr':145C 'high':72B 'high-sever':71B 'http':9A,58B,110C 'impact':138C 'integr':135C 'log':60B 'n/ac':144C 'n/s':147C 'n/ui':146C 'network':107C 'on-prem':20B 'oracl':1A,24B,30B,78C,83C,113C,126C 'oracle-eb':23B 'per':67B 'prem':22B 'product':66B,81C 'rate':74B 'reach':55B 'remot':51B 'result':122C 'score':132C 'sever':73B 'ship':6A,27B,31B,79C,114C,127C 'shipping-execut':26B 'success':116C 'suit':5A,37B,87C 'support':91C 'take':63B 'takeov':12A,124C 'u/c':148C 'unauthent':8A,104C 'vector':140C 'vendor':29B 'version':38B,92C 'via':109C 'vulner':75C,102C,120C 'without':59B 'workflow':47B,89C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Shipping Execution module in use. The sources do not say which configurations expose the Workflow Events component, so whether internet-facing deployments are more exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101834","severity":null,"published_at":"2026-10-20T22:18:39+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}