CVE-2026-60875: Oracle Trade Management Auth Bypass Flaw

CVE-2026-60875 Overview

CVE-2026-60875 is a high-severity vulnerability in the Oracle Trade Management product of Oracle E-Business Suite, specifically within the Claim LOV component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Trade Management accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read, modify, or delete all data accessible to Oracle Trade Management, undermining the confidentiality and integrity of trade, claim, and customer records.

Affected Products

Oracle E-Business Suite — Oracle Trade Management, version 12.2.3
Oracle E-Business Suite — Oracle Trade Management, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Trade Management, version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60875 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60875

Vulnerability Analysis

The vulnerability resides in the Claim List of Values (LOV) component of Oracle Trade Management. LOV components in Oracle E-Business Suite render selectable data lists that back form fields such as claim identifiers, customer references, and account records. An authenticated user with low privileges can send crafted HTTP requests to the Claim LOV endpoint and reach data outside their intended authorization scope.

Because the attack occurs over the network and requires no user interaction, exploitation fits well within standard web session workflows. The scope remains unchanged, meaning the impact is confined to Oracle Trade Management. However, all data accessible to Trade Management, including customer claims, settlement information, and related financial records, is at risk of unauthorized disclosure or manipulation. Availability is not directly affected.

The EPSS score is 0.365% as of 2026-07-23, indicating a lower current probability of exploitation activity. This score can shift once technical details or proof-of-concept code become public.

Root Cause

Oracle has not publicly disclosed a CWE classification for CVE-2026-60875. Based on the impact profile — low-privilege authenticated access producing high confidentiality and integrity impact within one component — the root cause is consistent with an access control or input validation weakness in the Claim LOV data retrieval path. The component appears to trust caller-supplied parameters when returning or acting on claim records.

Attack Vector

Exploitation requires a valid, low-privileged application account and network reachability to the Oracle E-Business Suite web tier over HTTP. The attacker interacts with the Claim LOV endpoint using standard EBS session credentials, issuing crafted requests to enumerate or modify records that the authenticated role should not otherwise be able to reach. No local access, no elevated role, and no user interaction with a victim are required.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor guidance on affected components.

Detection Methods for CVE-2026-60875

Indicators of Compromise

Unusual HTTP request patterns from low-privileged EBS accounts targeting Claim LOV URLs under the Oracle Trade Management (ozf) module.
Unexpected read, insert, update, or delete activity in Oracle Trade Management claim tables from user sessions not tied to claims workflows.
Elevated volumes of LOV query responses returning records outside the requester's operating unit or business role.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate low-privileged user sessions with Trade Management LOV endpoints.
Monitor database audit logs for anomalous DML against OZF_% tables originating from apps-tier sessions bound to non-claims users.
Deploy web application firewall rules on the EBS web tier that flag repeated parameter tampering or enumeration against Claim LOV request paths.

Monitoring Recommendations

Forward EBS access logs, concurrent request logs, and database audit trails to a centralized SIEM for correlation across identity, application, and database layers.
Baseline normal Claim LOV query rates per user role and alert on statistical deviations, particularly outside business hours.
Track authentication events for service and integration accounts that should not interact with the Claim LOV component and alert on any such activity.

How to Mitigate CVE-2026-60875

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite 12.2 to all instances running Trade Management versions 12.2.3 through 12.2.15.
Inventory all user accounts with any Trade Management responsibility and revoke access that is not strictly required.
Rotate credentials for accounts that have interacted with the Claim LOV component if audit evidence is incomplete for recent activity.

Patch Information

Oracle addressed CVE-2026-60875 in the Critical Patch Update released in July 2026. Administrators should download and apply the patch referenced in the Oracle Security Alert July 2026 using the standard adop online patching workflow for EBS 12.2. Validate the patch application by confirming the fix version in Trade Management module metadata after cutover.

Workarounds

Restrict network access to the EBS web tier so that only trusted corporate networks and VPN clients can reach the Trade Management endpoints.
Tighten responsibility and menu assignments so that only claim-handling personnel retain access to the Claim LOV component until patching completes.
Enable enhanced auditing on Trade Management functions and database objects to shorten detection time while the patch is being staged.