What is the CVSS score of CVE-2026-62447?

CVE-2026-62447 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Trade Management are affected by CVE-2026-62447?

Oracle E-Business Suite Trade Management module (Claim LOV component, versions 12.2.3-12.2.15) contains a critical authentication bypass that allows low-privileged users with network access to fully…

How to fix or mitigate CVE-2026-62447?

Within 24 hours: Audit and document all systems running Oracle E-Business Suite versions 12.2.3-12.2.15, particularly those exposed to internal networks or third-party access, and disable Trade Management Claim LOV functionality if operationally feasible. Within 7 days: Implement network-level access controls restricting HTTP traffic to the affected module to only authorized users and systems; establish enhanced logging and alerting for Trade Management module access and changes. Within 30 days: Contact Oracle for extended support options and technical guidance on compensating controls; evaluate upgrade path to versions 12.2.16 or later, or implement comprehensive application-level access restrictions and monitoring if immediate patching is not feasible.

Oracle Trade Management CVE-2026-62447

EUVD-2026-47498 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rmcg-62qf-wfcm

Privilege Escalation Oracle Trade Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable and low complexity, but a valid low-privileged EBS account is required (PR:L); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:48 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in takeover of Oracle Trade Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Trade Management is a channel-revenue-management module of the Oracle E-Business Suite (EBS) 12.2 application stack, delivered through the Oracle Application Server / WebLogic-fronted HTTP tier. The affected sub-component, 'Claim LOV' (List of Values), is a lookup/query interface used to resolve claim-related reference data; LOV endpoints in EBS are frequently implicated in injection and access-control weaknesses because they accept user-supplied parameters that feed backend queries. No CWE was assigned in the source data, so the precise root-cause class (e.g., SQL injection, improper authorization, or parameter tampering) cannot be confirmed; the C:H/I:H/A:H impact combined with 'takeover' language is consistent with an injection-style flaw that escalates a low-privileged application user to full control of the module.

RemediationAI

Patch available per Oracle's July 2026 Critical Patch Update - apply the Oracle Trade Management / E-Business Suite 12.2 patches referenced at https://www.oracle.com/security-alerts/cpujul2026.html for your exact 12.2.x level (an explicit fixed version number was not provided in the input, so consult the CPU matrix for the correct patch set). Because Oracle bundles fixes quarterly, install the full CPU rather than a single hotfix. Until patching is complete, compensating controls include restricting network access to the Trade Management / Claim LOV endpoints to trusted internal segments (e.g., via reverse-proxy URL filtering or WAF rules on the EBS HTTP tier), tightening application role assignments so only necessary users hold Trade Management responsibilities (reducing the pool of low-privileged accounts that satisfy PR:L), and increasing monitoring of Claim LOV request parameters - with the trade-off that URL filtering may break legitimate claims workflows and must be validated against business use.