---
id: "CVE-2026-101834"
kind: "vulnerability"
aliases: ["CVE-2026-101834"]
title: "Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw allows takeover"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "on-prem", "oracle-ebs", "shipping-execution", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:18:39+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:06:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101834", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw allows takeover

Oracle Shipping Execution in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Workflow Events component. A remote attacker who can reach it over HTTP without logging in can take over the product, per the CVSS 8.1 high-severity rating.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and whether it falls within 12.2.3 through 12.2.15 (sources do not give a command for this)
- Confirm whether Shipping Execution is in use and whether its HTTP endpoints are reachable from outside the network: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Shipping Execution in E-Business Suite; the patch version is unknown from the sources
- Move to a supported E-Business Suite release outside 12.2.3 through 12.2.15: unknown

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101834

## From the sources

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_