Oracle Transportation Management CVE-2026-60583

Exploitation requires (1) network access to the Oracle Transportation Management HTTP interface and (2) a valid low-privileged account on the OTM instance (CVSS PR:L - authenticated, not anonymous). It specifically affects supported version 6.5.3 with the vulnerable 'Install' component present. Limiting factors that reduce real-world risk: the attacker must possess or obtain low-level credentials (this is not unauthenticated exploitation despite the high severity), and only OTM 6.5.3 is confirmed affected. No special non-default configuration is called out by Oracle, and no user interaction is needed (UI:N), so any authenticated user reaching the HTTP endpoint can attempt it.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a genuinely serious, easily exploitable issue: network reachable over HTTP, low attack complexity, no user interaction, and only low privileges required, yielding total CIA impact. Oracle explicitly calls it 'easily exploitable' and resulting in 'takeover.' However, several corroborating signals are absent - no EPSS score, no KEV listing, and no public POC - so exploitation is currently unproven despite the high theoretical severity. There is also a notable inconsistency: the intelligence tag reads 'Information Disclosure,' yet the CVSS vector and Oracle's own text describe full integrity and availability compromise (takeover); the CVSS/description should be trusted over the single-word tag. Because PR:L requires an existing low-privileged account, real-world risk is highest for OTM deployments exposed to many authenticated users, partners, or where credentials are easily obtained; it is not a fully unauthenticated internet-wide threat.

An attacker who already holds a low-privileged OTM account - for example a limited carrier, partner, or internal user - sends crafted HTTP requests to the application's exposed interface and escalates to a full takeover of the Oracle Transportation Management instance, gaining read/write control over logistics data and application functions. Given AC:L and no required user interaction, the attack is straightforward once network and account access exist, though no public exploit code has been identified at time of analysis.