PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60584 Oracle Corporation CVE debrief

A vulnerability was discovered in Oracle Transportation Management (component: CSV Management). The supported version affected is 6.5.3. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Transportation Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management.

Vendor
Oracle Corporation
Product
Oracle Transportation Management
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-06
Advisory published
2026-07-21
Advisory updated
2026-08-06

Who should care

Organizations using Oracle Transportation Management version 6.5.3 should prioritize patching this vulnerability to prevent potential data breaches and service disruptions. This involves reviewing system deployments, applying patches, and implementing compensating controls like network segmentation and access controls. Security teams should also monitor for suspicious activity and review incident response plans to address potential exploitation.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 7.6, indicating high severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), showing that the vulnerability can be exploited over the network with low privileges, leading to high impacts on confidentiality, low impacts on integrity, and low impacts on availability. Oracle Transportation Management version 6.5.3 is affected, specifically the CSV Management component. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Transportation Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from Oracle as soon as possible
  • Conduct a thorough inventory check to identify all instances of Oracle Transportation Management version 6.5.3
  • Implement compensating controls such as network segmentation and access controls to limit the attack surface
  • Monitor for suspicious activity and implement exception tracking for potential exploitation attempts
  • Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record was published on 2026-07-21T22:17:58.823Z and was last modified on 2026-07-27T16:18:07.777Z. The NVD entry is currently Undergoing Analysis. The vulnerability is described in the Oracle Security Alert for July 2026.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60584 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60584

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60584 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60584

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.