What is the CVSS score of CVE-2026-60583?

CVE-2026-60583 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Transportation Management are affected by CVE-2026-60583?

Oracle Transportation Management 6.5.3 contains a critical remote vulnerability (CVSS 8.8) allowing low-privileged attackers to achieve complete system takeover, affecting all confidentiality,…

How to fix or mitigate CVE-2026-60583?

Within 24 hours, identify and document all Oracle Transportation Management 6.5.3 instances in your environment and restrict network access to trusted internal systems only. Within 7 days, implement comprehensive audit logging and network segmentation to isolate the application, enforce strict access controls limiting usage to essential personnel, and scan systems for evidence of exploitation attempts. Within 30 days, coordinate with Oracle support regarding interim security measures and a timeline for vendor-released patches; establish a plan to upgrade all instances to a patched version when available; implement continuous vulnerability monitoring and incident response procedures for potential system compromise affecting supply chain operations.

Oracle Transportation Management CVE-2026-60583

EUVD-2026-46945 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-jmrm-j3qv-28mr

Privilege Escalation Oracle Transportation Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP network vector (AV:N) with low complexity (AC:L) and no interaction; a low-privileged account is required (PR:L), and Oracle's 'takeover' outcome yields full C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:30 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Transportation Management 6.5.3 (Supply Chain suite, Install component) is possible for a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability loss - Oracle describes the outcome as a 'takeover' of the product. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Oracle Transportation Management (OTM) is a Java/WebLogic-based enterprise transportation and logistics management application within the Oracle Supply Chain product family, typically deployed as an internal or partner-facing web application. The affected component is 'Install', which relates to the installation/deployment tier of the product. No CWE was assigned (CWE: N/A) and Oracle's advisory intentionally withholds root-cause detail, so the precise weakness class cannot be confirmed. The CVSS vector (AV:N, HTTP-based) indicates a web-reachable flaw exercised over the application's HTTP interface, and the C:H/I:H/A:H impact with scope-unchanged (S:U) points to an application-level takeover of the OTM instance itself rather than a break-out to the underlying host.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 - the primary and vendor-sanctioned remediation is the CPU patch set referenced at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; Oracle CPUs do not publish a separate incremented product version in the advisory, so cite the CPU July 2026 patch level rather than an invented version number). Because Oracle patches are cumulative, ensure the OTM environment is brought to the current CPU baseline. As compensating controls until patching, restrict network reachability of the OTM HTTP interface to trusted internal segments and VPN only (reduces the AV:N exposure but breaks partner/browser access from untrusted networks), tighten and audit low-privilege account provisioning and enforce strong authentication/MFA since exploitation needs only PR:L (adds login friction), and place a WAF or reverse proxy in front of the application to monitor and rate-limit anomalous HTTP requests (may generate false positives against legitimate logistics traffic). These controls mitigate but do not eliminate the flaw; patching remains mandatory.