Oracle Trade Management CVE-2026-62447

Exploitation requires network HTTP access to an Oracle E-Business Suite 12.2.3-12.2.15 instance with the Oracle Trade Management module deployed, plus a valid low-privileged application account (PR:L) able to reach the Claim LOV component - no administrative rights and no user interaction are needed (UI:N, AC:L). The limiting factors are therefore: the target must be running an affected 12.2.x version with Trade Management enabled, and the attacker must possess or obtain some authenticated (even minimal) EBS session; a fully unauthenticated internet stranger cannot exploit it. Environments that expose EBS only internally and tightly control low-level responsibilities materially reduce the realistic attack surface.

The signals point to a genuine high priority rather than an inflated CVSS: the vector is network-reachable (AV:N), low complexity (AC:L), needs no user interaction (UI:N), and requires only low privileges (PR:L) - meaning any authenticated EBS user with minimal rights can reach it over HTTP. Full C:H/I:H/A:H impact yields the 8.8 score and matches the vendor's 'takeover of Oracle Trade Management' description. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-in-the-wild probability cannot be quantified; the absence of KEV/POC should not be read as low real-world risk, since Oracle EBS is a high-value target and Critical Patch Update flaws are routinely reverse-engineered from patches. One caveat: the input tags this as 'Information Disclosure,' which is narrower than the C:H/I:H/A:H 'takeover' impact - the tag likely understates the true impact, so defenders should treat the CVSS-derived full-compromise assessment as authoritative.

A user holding any low-privileged Oracle Trade Management responsibility (or a foothold on a stolen low-level EBS account) sends a crafted HTTP request to the Claim LOV endpoint, abusing the lookup parameters to bypass access controls or inject into the backend query. With low attack complexity and no user interaction required, the request escalates the attacker to full control of the Trade Management module, allowing them to read, alter, or destroy claim and channel-revenue data. No public exploit code has been identified at time of analysis.