Oracle Trade Management CVE-2026-101667

Exploitation requires (1) a low-privileged authenticated account on Oracle Trade Management within Oracle E-Business Suite (PR:L), reachable over HTTP (AV:N); (2) the specific Claim LOV component to be in use; and (3) human interaction from a person other than the attacker (UI:R) - a separate victim user must view or interact with the attacker-supplied data for the attack to succeed. Affected deployments are Oracle Trade Management versions 12.2.3 through 12.2.15. The required second-user interaction and the need for a valid low-privilege account are the principal limiting factors that reduce realistic risk below what a network-facing CVSS base score alone might imply; the scope change (S:C) means successful attacks can affect products beyond Trade Management.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that should be patched in the normal Oracle CPU cycle rather than treated as an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but constrained flaw: the attacker must already hold a low-privileged Oracle Trade Management account (PR:L) AND must induce a separate victim to interact (UI:R), which substantially lowers real-world exploitability versus a pure unauthenticated RCE. Impact is partial - limited read (C:L) and limited unauthorized update/insert/delete (I:L), no availability impact (A:N) - but the scope change (S:C) is notable because successful attacks 'may significantly impact additional products' beyond Trade Management itself, which is what elevates the score. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or imminent exploitation; this is a priority-by-process issue, not a drop-everything one. CONFLICTING SIGNAL: the input Tag 'Authentication Bypass' contradicts the CVSS vector - PR:L plus UI:R plus S:C with C:L/I:L is the classic signature of a stored/reflected cross-site scripting or similar injection flaw, not an authentication bypass; treat the tag as suspect and rely on the vector and description. CWE is N/A in the source data, so the precise weakness class is unconfirmed.

A low-privileged but authenticated Oracle Trade Management user crafts malicious input in the Claim LOV (list-of-values) component; when a higher-value victim user (e.g., a claims approver) later views or interacts with that data, the payload executes in the victim's authenticated session. Because the vulnerability carries a scope change, the resulting unauthorized read and update/insert/delete actions can extend to data or products beyond Trade Management. No public exploit code was identified at time of analysis, and exploitation hinges on the required victim interaction.