This vulnerability affects Oracle Trade Management versions 12.2.3 through 12.2.15, specifically in the Claim LOV component. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists many patched products but does not explicitly state patch availability or remediation for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Trade Management. This results in a high impact on confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the advisory does not explicitly confirm the availability of a patch or official remediation for CVE-2026-60877. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until an official fix is confirmed, monitor Oracle's advisories for updates. No vendor statement indicates that no action is required or that the issue is already mitigated.