CVE-2026-60812 in Supply Chain Trading Connector
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Supply Chain Trading Connector accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Supply Chain Trading Connector, a component of the Oracle E-Business Suite ecosystem that facilitates supply chain collaboration and data exchange processes. The specific flaw is located in the Collaboration History functionality, which manages historical records of trading activities between supply chain partners. This component serves as a critical interface for business transactions and data synchronization across enterprise boundaries, making it an attractive target for malicious actors seeking unauthorized access to sensitive commercial information.
The technical implementation flaw represents a privilege escalation vulnerability that operates through the HTTP protocol interface, allowing attackers with minimal privileges to exploit the system without requiring physical access or complex authentication mechanisms. The vulnerability's low attack complexity and network-based exploitation vector make it particularly dangerous as it can be triggered remotely from any location with internet connectivity. The affected versions spanning 12.2.3 through 12.2.15 indicate a substantial release range where organizations using these specific Oracle E-Business Suite versions remain at risk, suggesting that the flaw has persisted across multiple maintenance releases without adequate remediation.
The operational impact of this vulnerability extends beyond simple data theft to encompass potential complete system compromise, as successful exploitation grants unauthorized access to all data accessible through the Supply Chain Trading Connector. This encompasses sensitive supply chain information including vendor details, procurement records, inventory levels, and transaction histories that form the backbone of enterprise supply chain management operations. The confidentiality impact rating of high severity reflects the critical nature of the exposed data, which could enable competitive disadvantage, regulatory violations, and potential financial losses for affected organizations.
Organizations should implement immediate mitigations including network segmentation to restrict access to the vulnerable component, deployment of web application firewalls to monitor and filter HTTP traffic, and implementation of robust authentication controls to reduce the attack surface. The vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) and T1046 (Network Service Scanning) in its exploitation methodology. Regular security assessments and patch management processes should be prioritized to address this vulnerability, while monitoring for suspicious network activity targeting the affected Oracle components remains essential for early threat detection and response.