What is the CVSS score of EUVD-2026-46946?

EUVD-2026-46946 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Transportation Management are affected by EUVD-2026-46946?

Oracle Transportation Management 6.5.3 contains a high-severity vulnerability allowing low-privilege authenticated users to access all stored transportation and logistics data, modify records, and…

How to fix or mitigate EUVD-2026-46946?

Within 24 hours, identify all Oracle OTM 6.5.3 deployments and audit access logs for suspicious data access by low-privilege accounts. Within 7 days, implement network segmentation or firewall rules restricting OTM HTTP access to authorized segments only, and begin testing Oracle's July 2026 Critical Patch Update in a staging environment. Deploy the July 2026 Critical Patch Update to all OTM 6.5.3 instances within 30 days, conduct a data integrity audit for unauthorized modifications, and verify access controls restrict low-privilege permissions appropriately.

Oracle Transportation Management EUVD-2026-46946

| CVE-2026-60584 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-33mm-xf58-3962

Authentication Bypass Denial Of Service Oracle Transportation Management

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Network HTTP reach with an already-authenticated low-privilege user (PR:L, AC:L), primarily broad data disclosure (C:H) with only limited unauthorized writes and partial DoS (I:L/A:L), no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:29 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

AnalysisAI

Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The flaw resides in the CSV Management component of Oracle Transportation Management (OTM), a web-based enterprise logistics and freight/transportation planning platform delivered as part of Oracle Supply Chain. CSV Management handles import/export of comma-separated data, a common vector for injection, parsing, and access-control weaknesses when uploaded or requested content is not properly validated or authorized. No CWE was assigned in the source data (CWE: N/A), so the precise root-cause class is not formally identified, but the high confidentiality impact combined with limited integrity/availability impact and the 'Authentication Bypass' tag is consistent with a broken-access-control or injection issue in the CSV handling path that lets an authenticated but low-privileged user reach data beyond their authorization scope.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for Oracle Transportation Management 6.5.3, as Oracle does not publish standalone point-release version numbers in the source data - consult the CPU matrix for the exact patch bundle for your deployment. Because exploitation requires an authenticated low-privileged account, interim compensating controls until patching include restricting access to the CSV Management/import-export functionality to trusted roles only, tightening application authorization so low-privilege users cannot reach CSV endpoints, placing OTM behind a VPN or IP-allowlisted reverse proxy to limit network reachability (trade-off: may impede legitimate remote or partner users), and increasing audit logging on CSV import/export operations to detect abuse (trade-off: added log volume and no prevention). Review and prune unnecessary low-privilege accounts to shrink the exploitable population.