This vulnerability affects Oracle Trade Management versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) in the Claim LOV component. An attacker with low privileges and network access via HTTP can exploit this flaw to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Trade Management. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible within Oracle Trade Management. This compromises the confidentiality and integrity of sensitive business data managed by the product. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) should be monitored for patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.