This vulnerability in Oracle Trade Management's Claim LOV component affects supported versions 12.2.3 through 12.2.15. It is easily exploitable by a low privileged attacker with network access over HTTP, enabling unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Trade Management. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vendor advisory references a Critical Patch Update containing numerous patches but does not explicitly state a fix for this specific vulnerability. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Trade Management, as well as unauthorized access to all accessible data. This compromises the confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content provided does not explicitly confirm a patch or remediation for CVE-2026-60875. Organizations should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restrict network access to Oracle Trade Management interfaces and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.