What is the CVSS score of CVE-2026-60877?

CVE-2026-60877 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Trade Management are affected by CVE-2026-60877?

Oracle Trade Management (E-Business Suite) versions 12.2.3-12.2.15 contain an authorization flaw allowing low-privileged users to read, create, delete, or modify all application data without proper…

How to fix or mitigate CVE-2026-60877?

Within 24 hours, identify all Oracle E-Business Suite instances running Trade Management versions 12.2.3 through 12.2.15 and assess active user counts and data criticality. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems and validate that access controls are enforced post-patch. Within 30 days, conduct access logs review for the affected versions to detect and investigate any unauthorized data access or modifications during the exposure window.

Oracle Trade Management CVE-2026-60877

EUVD-2026-47162 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jj4x-wjmw-rfvp

Authentication Bypass Oracle Trade Management

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable HTTP endpoint (AV:N), easily exploitable (AC:L), requires a low-privileged authenticated account (PR:L), no user interaction; high confidentiality and integrity loss with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:40 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Trade Management (Oracle E-Business Suite, Claim LOV component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access read, create, delete, or modify all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity loss without affecting uptime. No public exploit identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Trade Management is a channel-revenue and claims management module within the Oracle E-Business Suite (EBS) ERP platform, typically fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected component, Claim LOV (List of Values), is a lookup/selection interface used within the Trade Management claims workflow. No CWE was assigned by NVD, but the pattern - a low-privilege authenticated user reaching data beyond their intended authorization scope via a web-facing LOV parameter - is consistent with improper access control or injection into a data-retrieval query (CWE-284/CWE-89 class). The vendor tag 'Authentication Bypass' suggests an authorization/access-control weakness rather than a memory-safety issue.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU) for E-Business Suite as documented at https://www.oracle.com/security-alerts/cpujul2026.html - patch available per vendor advisory; Oracle CPUs deliver the fix as cumulative patches applied via the standard EBS patching process rather than as a single named version string, so identify the specific Trade Management / EBS 12.2.x patch number for your release in that advisory. Until patched, reduce exposure by restricting network access to the EBS application tier and the Trade Management / Claim LOV pages to trusted internal networks or VPN, tightening role/responsibility assignments so low-privilege accounts cannot reach Trade Management functions, and monitoring HTTP access logs for anomalous Claim LOV requests; the trade-off is that access restrictions may impede legitimate remote or partner users of the claims workflow. Do not expose the EBS application tier directly to the internet without a WAF and access controls.