{"id":"CVE-2026-101835","kind":"vulnerability","aliases":["CVE-2026-101835"],"related":[],"title":"Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw exposes data","description":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's Shipping Execution module has a flaw in its Workflow Events component that can be reached over HTTP without logging in. A remote attacker can read critical data stored in Shipping Execution, per the CVSS vector (confidentiality high, no integrity or availability impact).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","on-prem","oracle-ebs","shipping-execution","vendor"],"not_affected_if":["shipping-execution-not-used"],"how_to_check":"- Check the installed Oracle E-Business Suite release and Shipping Execution patch level in the EBS admin screens.\n- Confirm whether Shipping Execution (Workflow Events) is reachable from untrusted networks over HTTP.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Shipping Execution, as listed in the Oracle advisory (fixed release not stated in the sources).\n- Move affected `12.2.3` through `12.2.15` installs to a patched release.","status":"open","published_at":"2026-10-20T22:18:39+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:18:58+00:00","updated_at":"2026-10-25T03:18:58+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:58Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite Shipping Execution, as listed in the Oracle advisory (fixed release not stated in the sources).\n- Move affected `12.2.3` through `12.2.15` installs to a patched release.","reach":"internet","title":"Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw exposes data","impact":"medium","summary":"Oracle E-Business Suite's Shipping Execution module has a flaw in its Workflow Events component that can be reached over HTTP without logging in. A remote attacker can read critical data stored in Shipping Execution, per the CVSS vector (confidentiality high, no integrity or availability impact).","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","shipping-execution","erp","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote attacker reads critical Shipping Execution data.","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-101835 to get the fixed patch and whether the flaw is configuration dependent.","how_to_check":"- Check the installed Oracle E-Business Suite release and Shipping Execution patch level in the EBS admin screens.\n- Confirm whether Shipping Execution (Workflow Events) is reachable from untrusted networks over HTTP.","needs_analyst":true,"not_affected_if":["shipping-execution-not-used"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Shipping Execution module enabled and reachable over HTTP. Systems without Shipping Execution, or not exposed to the network, are less exposed; the sources do not say whether a specific configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":3468,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101835':15A,18A '-2026':14A,17A '/av':152C '12.2.15':101C '12.2.3':100C '3.1':142C,151C '7.5':145C 'access':110C,127C,133C,139C 'affect':98C 'allow':105C 'attack':58B,107C,119C 'avail':76B 'base':143C 'busi':4A,33B,89C 'complet':132C 'compon':46B,91C 'compromis':114C 'confidenti':71B,146C 'critic':61B,129C 'cve':13A,16A 'cvss':69B,141C,148C,150C 'data':12A,62B,130C,140C 'e':3A,32B,88C 'e-busi':2A,31B,87C 'easili':102C 'eb':25B 'erp':19B 'event':45B,93C 'execut':7A,28B,37B,66B,83C,117C,138C 'exploit':103C 'expos':11A 'flaw':10A,41B 'h/i':158C 'high':72B 'http':9A,52B,112C 'impact':77B,147C 'integr':74B 'l/pr':154C 'log':54B 'modul':38B 'n':160C 'n/a':159C 'n/ac':153C 'n/s':156C 'n/ui':155C 'network':109C 'on-prem':20B 'oracl':1A,24B,30B,81C,86C,115C,136C 'oracle-eb':23B 'per':67B 'prem':22B 'product':84C 'reach':50B 'read':60B 'remot':57B 'result':124C 'score':144C 'ship':6A,27B,36B,65B,82C,116C,137C 'shipping-execut':26B 'store':63B 'success':118C 'suit':5A,34B,90C 'support':94C 'u/c':157C 'unauthent':8A,106C 'unauthor':126C 'vector':70B,149C 'vendor':29B 'version':95C 'via':111C 'vulner':78C,104C,122C 'without':53B 'workflow':44B,92C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Shipping Execution module enabled and reachable over HTTP. Systems without Shipping Execution, or not exposed to the network, are less exposed; the sources do not say whether a specific configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101835","severity":null,"published_at":"2026-10-20T22:18:39+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}