CVE-2026-101667
MediumCVSS 5.4Summary
Vulnerability in Oracle Trade Management (component Claim LOV) of Oracle E-Business Suite versions 12.2.3-12.2.15. It allows a low-privileged attacker with network access via HTTP to modify and read some data, but requires human interaction and may impact additional products.
Risk Assessment
Could lead to unauthorized modification or read access to Oracle Trade Management data and potentially affect related systems. However, it requires user interaction, limiting attack vectors.
Recommendation
Apply the security updates provided by Oracle for versions 12.2.3-12.2.15. Additionally, restrict network access to necessary addresses and monitor for suspicious user activity.
Other vulnerabilities in Oracle Trade Management
See all- CVE-2026-101666Medium
Vulnerability in Oracle Trade Management (component Claim LOV) of Oracle E-Business Suite versions 12.2.3-12.2.15. It allows a low-privileged attacker with network access via HTTP to modify and read some data, but requires human interaction and may impact additional products.
- CVE-2017-3446High
Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.
- CVE-2017-3445High
A vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-3444High
A vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2026-62447High
Vulnerability in Oracle Trade Management (Oracle E-Business Suite) component Claim LOV. Versions 12.2.3-12.2.15 are affected. A low-privileged attacker with network access via HTTP can compromise Oracle Trade Management.
- CVE-2026-60877High
Vulnerability in Oracle Trade Management (Claim LOV component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
- CVE-2026-60875High
Vulnerability in Oracle Trade Management (component: Claim LOV) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.
Original NVD description (English source)
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS