CVE-2026-101667 in Trade Management
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Oracle Trade Management component of Oracle E-Business Suite, specifically affecting the Claim List of Values functionality across supported versions ranging from 12.2.3 to 12.2.15. This security flaw represents a significant risk to organizations relying on this enterprise resource planning module for managing trade operations and claims processing. The core technical issue stems from insufficient validation or access control mechanisms within the Claim LOV interface, which allows an attacker with low privileges to manipulate data through standard HTTP network connections. While the vulnerability is technically located in Oracle Trade Management, its exploitation can lead to a scope change where additional products within the broader E-Business Suite environment are significantly impacted due to shared database structures or integrated workflows.
From a technical perspective, this flaw aligns closely with CWE-269 Improper Privilege Management and potentially CWE-798 Use of Hard-coded Credentials if authentication bypass is involved in specific configurations, though primarily it reflects weaknesses in authorization logic that permit unauthorized data manipulation. The attack vector requires the presence of an attacker who has low-level network access to the system via HTTP. Crucially, successful exploitation demands human interaction from a user other than the initial attacker, indicating that this vulnerability likely involves social engineering or phishing vectors where a victim must perform specific actions within the application interface to trigger the malicious payload. This requirement for user interaction classifies it under ATT&CK technique T1566 Phishing if external actors are involved in luring users into triggering the flaw.
The operational impact of this vulnerability is characterized by both confidentiality and integrity compromises, as reflected in its CVSS 3.1 base score of 5.4. A successful exploit enables an unauthorized actor to gain read access to a subset of data accessible within Oracle Trade Management, leading to potential information disclosure sensitive trade secrets or customer claims details. Furthermore, the attacker can perform unauthorized updates, inserts, and deletes on accessible data, which directly compromises data integrity. This dual impact means that not only is confidential information exposed, but critical business records related to financial claims and trade agreements can be altered or destroyed without proper authorization, potentially leading to significant financial loss and regulatory compliance issues for affected enterprises.
Mitigation strategies should prioritize immediate patching of the Oracle E-Business Suite environment to the latest available release containing the security fixes for this specific component. In cases where patching is not immediately feasible, organizations should implement strict network segmentation to limit HTTP access to low-privileged users who interact with Trade Management modules. Additionally, deploying web application firewalls can help detect and block anomalous patterns associated with exploiting list-of-values vulnerabilities. Security awareness training is also critical given the requirement for human interaction; employees must be educated on recognizing suspicious requests that might attempt to trigger this vulnerability through social engineering tactics. Regular auditing of access logs within Oracle Trade Management should be conducted to identify any unauthorized data modifications or unusual read activities indicative of exploitation attempts.