Oracle Transportation Management CVE-2026-60434

Exploitation requires a valid low-privilege user account on Oracle Transportation Management 6.5.3 and network access to the application via HTTP. The CVSS PR:L metric confirms authentication is required - unauthenticated attackers cannot exploit this flaw directly. No user interaction by a victim is required once the attacker holds a credential. No specific non-default configuration is indicated as a prerequisite; the flaw appears to exist in a default-enabled Authentication component. Exploitation is limited to confidentiality impact - an attacker cannot modify data or cause service disruption through this vector. Access is also constrained to 'a subset' of OTM data, not the full dataset, which further limits the realistic yield of a successful attack.

The CVSS 3.1 base score of 4.3 (Medium) is broadly consistent with the available signals. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network-reachable exploitation over HTTP with low complexity, but the PR:L metric confirms that a valid low-privilege account is required - this is not an unauthenticated attack. Impact is confined to partial confidentiality loss with no integrity or availability consequences. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. Neither CISA KEV listing nor public proof-of-concept code has been identified, suggesting limited real-world exploitation activity at this time. The 'easily exploitable' characterization from Oracle refers to attack complexity once an attacker holds a low-privilege credential, not to the ease of obtaining that credential. Real-world risk is moderate for organizations with externally accessible OTM deployments or shared user environments where insider threat or credential compromise is plausible. The constrained impact scope - a subset of readable data, no write or availability impact - limits blast radius even in successful exploitation.

An attacker with a valid low-privilege account on an internet-facing Oracle Transportation Management 6.5.3 deployment sends crafted HTTP requests to the Authentication component, bypassing access controls to read data outside their authorized scope - such as shipment records, routing data, or counterparty information belonging to other users or roles. No public exploit code has been identified, but the 'easily exploitable' Oracle classification suggests the technique is straightforward once credentials are available.