Is CVE-2026-60877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60877 being exploited in the wild.

How severe is CVE-2026-60877?

High severity, with a CVSS score of 8.1, published 21 July 2026.

Which products and versions are affected?

Oracle Trade Management 12.2.3-12.2.15.

Is there a fix for CVE-2026-60877?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-60877 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-60877?

Check whether you run Oracle Trade Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60877: Oracle Trade Management unauthorized data access in Claim LOV

CVE-2026-60877 · Severity: high · CVSS 8.1 · Published 2026-07-21

Oracle Trade Management, a component of the Oracle E-Business Suite used for managing trade promotions and claims, contains a security vulnerability in its Claim List of Values (LOV) component. An attacker with basic user credentials can exploit this flaw over the network to gain unauthorized access to sensitive business data. This could result in the theft, deletion, or modification of critical financial and trade information, potentially disrupting business operations and compromising financial integrity.

Technologies: Oracle Trade Management. Vendors: Oracle.

Quick answers

Is CVE-2026-60877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60877 being exploited in the wild.
How severe is CVE-2026-60877?: High severity, with a CVSS score of 8.1, published 21 July 2026.
Which products and versions are affected?: Oracle Trade Management 12.2.3-12.2.15.
Is there a fix for CVE-2026-60877?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-60877 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-60877?: Check whether you run Oracle Trade Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Claim LOV component of Oracle Trade Management (part of Oracle E-Business Suite). The flaw is categorized as easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation enables unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible by the Trade Management module. The vulnerability affects versions 12.2.3 through 12.2.15. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.

Affected products

Oracle Corporation Oracle Trade Management 12.2.3-12.2.15

Timeline

2026-07-21: advisory: Initial publication by Oracle and NVD

References

https://www.oracle.com/security-alerts/cpujul2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.