CVE-2026-62599 in Trading Community
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Third Party Data Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trading Community. While the vulnerability is in Oracle Trading Community, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trading Community accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Third Party Data Integration component of Oracle Trading Community, a core module in the Oracle E-Business Suite ecosystem. This flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this security weakness is particularly severe because it permits exploitation by an unauthenticated attacker who requires only network access via HTTP to initiate a compromise. Unlike many vulnerabilities that require user interaction or valid credentials, this flaw allows for remote code execution or data exfiltration without any prior authentication, significantly lowering the barrier to entry for malicious actors targeting enterprise environments running these specific versions of Oracle E-Business Suite.
The technical impact of this vulnerability extends beyond the immediate boundaries of the Trading Community module due to a scope change in attack potential. While the root cause is localized within the Third Party Data Integration functionality, successful exploitation can lead to unauthorized access to critical data and potentially complete access to all data accessible by Oracle Trading Community. This broadens the blast radius considerably, as it may impact additional products integrated with or dependent on the compromised module. The high confidentiality impact reflected in the CVSS 3.1 Base Score of 8.6 underscores the severity of potential data exposure, which could include sensitive customer information, financial records, and proprietary business intelligence stored within the suite.
From a classification perspective, this vulnerability aligns with CWE-209, which describes an Information Exposure Through an Error Message, or potentially CWE-79 if it involves cross-site scripting leading to session hijacking, depending on the specific technical mechanism of data leakage. In terms of adversarial tactics as defined by MITRE ATT&CK, this scenario maps closely to T1530, Data from Local System, and T1046, Network Service Discovery, followed by T1005, Data from Local System. The lack of authentication requirements places it firmly in the category of high-severity remote vulnerabilities that are frequently targeted in automated scanning campaigns and initial access vectors for broader enterprise compromises.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle E-Business Suite where this vulnerability has been addressed by vendor security updates. In environments where immediate patching is not feasible, network-level controls should be implemented to restrict HTTP access to the affected components from untrusted networks. Web Application Firewalls can also be configured with specific rulesets to detect and block exploit attempts targeting the Third Party Data Integration endpoints. Regular vulnerability scanning and penetration testing are essential to identify any residual exposure or misconfigurations that might allow attackers to bypass these controls, ensuring a defense-in-depth approach is maintained against this significant risk vector.