This vulnerability in Oracle Trade Management affects versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to gain unauthorized access and modify critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required and low attack complexity. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references numerous patches but does not explicitly confirm a fix for this vulnerability. Customers are advised to review the advisory and apply patches promptly if available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Trade Management, compromising confidentiality and integrity of all accessible data. There is no impact on availability. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable.

Oracle has released a Critical Patch Update advisory in July 2026 covering many vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-60875. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying all relevant security patches promptly and remaining on actively supported versions. No specific temporary mitigations are provided in the advisory.