PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60877 Oracle CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:24.353Z and has not been modified since then. The CVE-2026-60877 vulnerability affects Oracle Trade Management, a component of Oracle E-Business Suite, specifically the Claim LOV issue. This vulnerability has a CVSS 3.1 Base Score of 8.1, indicating high severity. An easily exploitable vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Trade Management, leading to unauthorized creation, deletion, or modification access to critical data or all Oracle Trade Management accessible data, as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. Organizations should review and apply the necessary security patches. IT administrators, security teams, and Oracle E-Business Suite users should prioritize patching this vulnerability to prevent potential data breaches.

Vendor
Oracle
Product
Trade Management
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-12
Advisory published
2026-07-21
Advisory updated
2026-08-12

Who should care

Organizations using Oracle Trade Management versions 12.2.3-12.2.15 should prioritize patching this vulnerability to prevent potential data breaches. IT administrators, security teams, and Oracle E-Business Suite users should review and apply the necessary security patches.

Technical summary

The CVE-2026-60877 vulnerability affects Oracle Trade Management, a component of Oracle E-Business Suite. The vulnerability is due to a Claim LOV issue and has a CVSS 3.1 Base Score of 8.1, indicating high severity. An easily exploitable vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Trade Management, leading to unauthorized creation, deletion, or modification access to critical data or all Oracle Trade Management accessible data, as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data.

Defensive priority

Oracle Trade Management vulnerability allows low-privileged attackers to compromise data integrity and confidentiality via HTTP.

Recommended defensive actions

  • Review and apply Oracle's security patches for Trade Management versions 12.2.3-12.2.15.
  • Restrict network access to Trade Management systems to only necessary personnel.
  • Monitor Trade Management systems for suspicious activity.
  • Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent attacks.
  • Verify that affected systems are properly configured and up-to-date.

Evidence notes

The CVE-2026-60877 vulnerability affects Oracle Trade Management versions 12.2.3-12.2.15, allowing low-privileged attackers with network access via HTTP to compromise the system, leading to unauthorized data creation, deletion, or modification. The CVSS 3.1 Base Score is 8.1, indicating high severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60877 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60877

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60877 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60877

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.