CVE-2026-60957: CSRF
Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Transportation Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Execution accessible data as well as unauthorized read access to a subset of Oracle Transportation Execution accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Transportation Execution (Oracle E-Business Suite component: Internal Operations)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15 - Compensating control
Restrict network access to Oracle Transportation Execution over HTTP so low-privileged attackers cannot reach the vulnerable component.
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to supported Oracle Transportation Execution versions 12.2.3 through 12.2.15, specifically the Internal Operations component. Exploitation requires network access to the affected service over HTTP and a low-privileged authenticated attacker account.
What conditions are required for exploitation?
The attacker must induce a person other than the attacker to interact with a malicious request. The vulnerability is classified as CSRF, so successful exploitation depends on that user interaction in addition to the attacker already having low-level privileges.
What could an attacker do after successful exploitation?
A successful attack can allow unauthorized reading of a subset of accessible Oracle Transportation Execution data and unauthorized updates, inserts, or deletions of some accessible data. The reported scope change means effects may significantly impact additional products.