This vulnerability affects Oracle Trade Management versions 12.2.3 through 12.2.15, specifically in the Claim LOV component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling compromise of the product and potentially full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm the patch status for this vulnerability. Oracle recommends applying patches without delay to address such vulnerabilities.

Successful exploitation can lead to complete compromise of Oracle Trade Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized data access, modification, or disruption of services.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio, including Oracle Trade Management. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-62447. Customers should review the July 2026 Critical Patch Update advisory and apply all relevant patches promptly. Until patches are applied, limit network exposure of Oracle Trade Management and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.