Description
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and disclosure
Action: Apply Patch
AI Analysis

Impact

Vulnerability in the Claim LOV component of Oracle Trade Management allows an attacker to perform unauthorized updates, inserts, deletes, and read access to data that the attacker can reach within the system. The weakness is moderate in severity, reflected by a CVSS 3.1 score of 5.4, and affects confidentiality and integrity of Oracle Trade Management data.

Affected Systems

Oracle Corporation’s Oracle Trade Management product (Oracle E‑Business Suite) is impacted. Supported affected versions are 12.2.3 through 12.2.15.

Risk and Exploitability

The flaw is reachable over HTTP from the network and requires only low‑privileged access, but it also demands human interaction from a user other than the attacker. Because the scope can change, successful exploitation might affect other Oracle products. The CVSS score indicates moderate risk, and the EPSS score of < 1% suggests a very low probability of exploitation, while the lack of a KEV listing indicates it is not currently in the known exploited vulnerabilities catalog.

Generated by OpenCVE AI on October 22, 2026 at 11:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for Oracle Trade Management 12.2.3–12.2.15 as issued by Oracle.
  • Restrict HTTP access to the Trade Management application to trusted network segments and limit exposure to the minimum required IP ranges.
  • Disable or tightly restrict the Claim LOV feature for users who do not require it, and enforce strict role‑based access controls to mitigate unauthorized data manipulation.

Generated by OpenCVE AI on October 22, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Claim LOV in Oracle Trade Management

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Claim LOV in Oracle Trade Management
Weaknesses CWE-668
CWE-862

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Claim LOV in Oracle Trade Management
Weaknesses CWE-668
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle trade Management
CPEs cpe:2.3:a:oracle:trade_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle trade Management
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Trade Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:31:53.794Z

Reserved: 2026-09-28T15:40:09.498Z

Link: CVE-2026-101666

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:59.103Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:20.813

Modified: 2026-10-21T19:16:55.200

Link: CVE-2026-101666

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses