What is the CVSS score of CVE-2026-60433?

CVE-2026-60433 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Oracle Transportation Management CVE-2026-60433

EUVD-2026-46830 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cv8p-fm9v-6wq3

Oracle Authentication Bypass Transportation Management

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible via HTTP; high privilege required per description; full confidentiality and integrity impact; no availability disruption described.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Integration). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.

Technical ContextAI

Oracle Transportation Management (OTM) is an enterprise supply chain logistics platform used to manage freight, carrier relationships, and shipment lifecycle. The affected component is the Integration subsystem, which is commonly responsible for handling API or EDI-style data interchange between OTM and external systems over HTTP. The affected version is 6.5.3. No CWE has been assigned, limiting root-cause classification; however, the 'Authentication Bypass' tag suggests either improper authorization enforcement (CWE-285) or privilege mismanagement (CWE-269) within the Integration component. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U indicates the flaw is straightforwardly exploitable over the network once authenticated, without race conditions or user interaction required.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed beyond the Oracle CPU advisory reference - organizations should consult Oracle's patch matrix within the CPU document to identify the specific build to apply. As a compensating control prior to patching, restrict network-level access to the OTM Integration component endpoints (HTTP) to only trusted internal IP ranges using firewall or WAF rules, noting that this does not eliminate the vulnerability but reduces the attacker's access window. Additionally, audit and reduce the number of accounts holding high-privileged roles in OTM, as PR:H means only those accounts can trigger this flaw - minimizing privileged account exposure limits blast radius without requiring downtime.