CVE-2026-60875 in Trade Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Trade Management, a component of the Oracle E-Business Suite, specifically affecting the Claim LOV (List of Values) functionality. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial release range where this security flaw persists. The vulnerability classification as easily exploitable suggests that attackers with minimal technical expertise can leverage this weakness, making it particularly dangerous for organizations running these older suite versions.
The technical nature of this flaw involves insufficient authorization controls within the Claim LOV component, allowing low privileged attackers who can establish network connections through HTTP to bypass normal access restrictions. This represents a critical authorization bypass vulnerability that operates at the application layer, enabling attackers to perform unauthorized operations against the underlying Oracle Trade Management system. The CVSS 3.1 base score of 8.1 reflects the severity of impact, with high confidentiality and integrity impacts indicating that successful exploitation could lead to complete data compromise.
The operational consequences of this vulnerability are severe and multifaceted, potentially enabling attackers to create, delete, or modify critical business data within the trade management system. This encompasses not just routine data manipulation but also complete access to all accessible data within Oracle Trade Management, representing a significant escalation from simple information disclosure. The unauthorized modification capabilities pose particular risks to business processes involving claims processing, contract management, and financial transactions that rely on accurate trade data integrity.
Organizations should prioritize immediate remediation through Oracle's security patches or updates addressing this specific vulnerability. Network segmentation and access controls should be implemented as temporary mitigations while permanent fixes are deployed. The vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing), as attackers might leverage this weakness after gaining initial network access through social engineering or other means. Regular security assessments should be conducted to identify similar authorization flaws across the Oracle E-Business Suite components, particularly focusing on LOV implementations that handle sensitive business data.
This vulnerability demonstrates how seemingly minor application-level controls can create significant security risks when insufficiently implemented, highlighting the importance of comprehensive security testing and regular patch management processes within enterprise environments. The combination of low privilege requirements with high impact potential makes this vulnerability particularly attractive to threat actors seeking persistent access to critical business systems.