This vulnerability affects Oracle Trade Management versions 12.2.3 through 12.2.15 and involves the Claim LOV component. It enables a low privileged attacker with network access via HTTP to compromise the system without user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWEs related to improper access control and authorization (CWE-306, CWE-287, CWE-269, CWE-284). Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability, and no direct patch links are provided.

Successful exploitation can lead to complete compromise of Oracle Trade Management, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access and control over sensitive trade management functions.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed, restrict network access to Oracle Trade Management and monitor for suspicious activity related to the Claim LOV component.