Oracle Transportation Management CVE-2026-60433

Exploitation requires the attacker to hold a high-privileged account within Oracle Transportation Management (PR:H per CVSS), with network access to the OTM server over HTTP. The affected component is the Integration subsystem of OTM 6.5.3 - deployments on this specific version with the Integration component enabled and HTTP-accessible are in scope. The 'Authentication Bypass' tag may indicate that high-privilege authentication is sufficient to trigger an authorization bypass within the Integration component, meaning no additional non-default configuration is required beyond standard OTM deployment. Exploitation is constrained by the need for a pre-existing high-privileged credential; unauthenticated or low-privileged attackers are not able to exploit this vulnerability based on the PR:H CVSS assignment. No availability impact is described, meaning this is a data theft and tampering flaw rather than a denial-of-service vector.

The CVSS 3.1 base score of 6.5 (Medium) reflects the PR:H constraint - only high-privileged accounts can exploit this flaw, which meaningfully limits the attack surface compared to unauthenticated or low-privilege vectors. However, the C:H/I:H impact metrics indicate that successful exploitation yields complete data access and modification rights across all OTM-accessible data, which is operationally severe for supply chain operators. No EPSS score was provided and no CISA KEV listing exists, suggesting no confirmed widespread exploitation. The 'Authentication Bypass' tag in combination with PR:H is notable and potentially conflicting: if this is a true authentication bypass, PR:N would be expected; the PR:H assignment suggests the bypass operates within an already-authenticated high-privilege context - possibly bypassing row-level or role-level authorization controls rather than defeating login entirely. This ambiguity should be verified against the Oracle CPU advisory. Real-world priority is moderate: the threat actor must first obtain a high-privileged OTM account, after which the damage potential is high.

An attacker who has compromised a high-privileged OTM administrator account - via phishing, credential stuffing, or insider access - connects to the OTM Integration component over HTTP and sends a crafted request that bypasses authorization controls. The attacker can then exfiltrate all supply chain records (shipments, carriers, contracts) or overwrite critical data, potentially disrupting logistics operations or enabling fraudulent cargo diversions. No public proof-of-concept code has been identified, so exploitation currently requires knowledge of the specific flaw mechanism.