CVE-2026-101667: Medium severity Oracle Trade Management vulnerability
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Trade Management deployments on supported Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected, specifically the Claim LOV component.
What does an attacker need to exploit this issue?
The attacker needs network access to the affected system via HTTP, low-privileged credentials, and interaction from another person. The attack complexity is low once those conditions are met.
What could a successful attacker do?
A successful attack can provide unauthorized read access to a subset of accessible Oracle Trade Management data and unauthorized update, insert, or delete access to some accessible data. The scope change indicates the impact may significantly affect additional products.