Oracle Trade Management CVE-2026-60877

Exploitation requires a valid low-privileged Oracle E-Business Suite account with network HTTP reachability to the Trade Management application tier and specifically to the Claim LOV component (CVSS PR:L, AV:N, UI:N - no victim interaction needed). It applies to EBS Trade Management versions 12.2.3 through 12.2.15. The limiting factor is authentication: despite the 'Authentication Bypass' tag, the CVSS vector confirms some low-level credentials are needed, so exposure is bounded by how many users hold EBS accounts and whether the application tier is internet-facing; instances reachable only from trusted internal networks materially reduce the attack surface.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction - an attractive profile because any authenticated EBS user could potentially reach data across the whole Trade Management scope. Oracle rates it 'Easily exploitable,' reinforcing low attack complexity. However, no EPSS score, no KEV listing, and no known POC are present in the provided data, so there is currently no evidence of active or imminent widespread exploitation; the practical risk is gated by the requirement for valid low-privilege credentials to the EBS instance. Note the tension between the 'Authentication Bypass' tag and the CVSS PR:L metric: PR:L means some authentication IS required, so this is more likely a privilege/authorization escalation from a low-privileged account than a true pre-auth bypass - verify the exact prerequisite against Oracle's advisory. This warrants priority patching for internet-exposed EBS instances but is not a drop-everything zero-day based on available signals.

An attacker who holds a low-privileged Oracle E-Business Suite account (or phishes one) sends crafted HTTP requests to the Trade Management Claim LOV interface to enumerate and manipulate claim and channel-revenue data beyond their authorized scope. Because no user interaction and only low privileges are needed, the attacker can read confidential financial data and create, alter, or delete critical records. No public exploit code is currently identified, so exploitation would require custom research against the affected endpoint.