Description
Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Supply Chain Trading Connector accessible data as well as unauthorized read access to a subset of Oracle Supply Chain Trading Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Supply Chain Trading Connector. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Published: 2026-07-21
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An exposed HTTP endpoint in Oracle Supply Chain Trading Connector allows low‑privileged users to modify, insert, delete, or read data beyond their authorization, as well as trigger partial denial of service. The vulnerability stems from improper access control (CWE-284) and results in degradation of confidentiality, integrity, and availability of transaction data.

Affected Systems

Oracle Corporation’s Oracle Supply Chain Trading Connector for Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. The flaw resides in the Collaboration History component and can be exploited by anyone with network connectivity to the Connector’s HTTP interface.

Risk and Exploitability

The CVSS 3.1 base score of 6.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of real‑world exploitation. The vulnerability is not listed in CISA KEV, but an attacker with low privileges can achieve it remotely over HTTP with minimal effort if network access is not restricted.

Generated by OpenCVE AI on August 4, 2026 at 02:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Jul 2026 patch or upgrade to a version where the vulnerability is resolved.
  • Restrict network access to the Oracle Supply Chain Trading Connector using firewall rules and enforce least‑privilege role configuration to limit update, insert, delete and read permissions to authorized users.
  • Disable unused or unnecessary HTTP endpoints in the Connector configuration to reduce the attack surface.

Generated by OpenCVE AI on August 4, 2026 at 02:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation and Partial Denial via HTTP in Oracle Supply Chain Trading Connector
Weaknesses CWE-284

Thu, 30 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation and Partial Denial via HTTP in Oracle Supply Chain Trading Connector

Mon, 27 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Title Low Privileged Remote Data Tampering and Partial DoS via Oracle Supply Chain Trading Connector
Weaknesses CWE-284

Fri, 24 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Low Privileged Remote Data Tampering and Partial DoS via Oracle Supply Chain Trading Connector
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Supply Chain Trading Connector accessible data as well as unauthorized read access to a subset of Oracle Supply Chain Trading Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Supply Chain Trading Connector. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
First Time appeared Oracle
Oracle supply Chain Trading Connector
CPEs cpe:2.3:a:oracle:supply_chain_trading_connector:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle supply Chain Trading Connector
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Oracle E-business Suite Supply Chain Trading Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:18:45.518Z

Reserved: 2026-07-08T15:51:55.592Z

Link: CVE-2026-60811

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:19.560

Modified: 2026-08-07T21:15:32.047

Link: CVE-2026-60811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:45:02Z

Weaknesses