What is the CVSS score of EUVD-2026-46831?

EUVD-2026-46831 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Transportation Management EUVD-2026-46831

| CVE-2026-60434 MEDIUM

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-6857-wwfr-22gx

Authentication Bypass Oracle Transportation Management

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network HTTP vector confirmed; PR:L because a valid low-privilege account is explicitly required; impact limited to partial confidentiality only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.

Technical ContextAI

Oracle Transportation Management (OTM) is a supply chain logistics platform used for freight and transportation operations. The affected component is Authentication, suggesting a flaw in how the application enforces access controls or validates session/credential context over HTTP. The vulnerability tag 'Authentication Bypass' implies that a low-privilege authenticated user can circumvent authorization checks to read data beyond their intended access scope. No CWE identifier was assigned in this record, which limits precise root-cause classification; however, the Authentication Bypass tag and the Authentication component together suggest a likely mapping to CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization). The affected version is Oracle Transportation Management 6.5.3, as confirmed by both the NVD record and ENISA EUVD-2026-46831.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability in Oracle Transportation Management 6.5.3. The advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed in the available references - organizations should consult the CPU documentation to verify the precise patch artifact. As a compensating control prior to patching, restrict HTTP access to the Oracle Transportation Management application to trusted internal networks or VPN-gated endpoints, reducing the attack surface for network-based exploitation. Additionally, audit and minimize the number of active low-privilege accounts to reduce the pool of credentials that could be leveraged. These controls do not eliminate the vulnerability but reduce exposure until the CPU patch is applied.