CVE-2026-60918

Analyzed Analyzed - Analysis Complete

Oracle Shipping Execution Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Shipping Execution. Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60918

EUVD

EUVD-2026-47185

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	shipping_execution	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Shipping Execution, part of Oracle E-Business Suite. It allows a highly privileged attacker with network access to take over the system by exploiting a flaw in the Internal Operations component. The attack requires HTTP access and can lead to full system compromise.

Detection Guidance

Detection requires checking for Oracle Shipping Execution versions 12.2.12 to 12.2.15. Inspect Oracle E-Business Suite logs for unusual HTTP access patterns or administrative actions. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take complete control of the Oracle Shipping Execution system. This may lead to unauthorized access to sensitive data, disruption of shipping operations, or further compromise of connected systems.

Compliance Impact

This vulnerability allows high privileged attackers to compromise Oracle Shipping Execution, potentially leading to unauthorized access, data breaches, or system takeover. Such breaches could violate GDPR (data protection), HIPAA (healthcare data), or other compliance standards by exposing sensitive information or disrupting critical operations.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for Shipping Execution component version 12.2.12-12.2.15. Restrict network access to HTTP interfaces and enforce least privilege for users with high privileges.

Hi! I’m here to help you understand CVE-2026-60918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70