CVE-2026-60434

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Oracle Transportation Management

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Oracle

Description

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60434

EUVD

EUVD-2026-46831

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	transportation_management	6.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an authentication-related vulnerability in Oracle Transportation Management version 6.5.3. It allows a low-privileged attacker with network access to read some data without needing to authenticate properly. The impact is limited to unauthorized data access, not modification or deletion.

Detection Guidance

Detection of this vulnerability requires checking for unauthorized access attempts to Oracle Transportation Management via HTTP. Monitor network traffic for suspicious requests targeting the authentication component of Oracle Transportation Management version 6.5.3. Check logs for low-privileged users accessing data they should not have permission to view.

Impact Analysis

If you use Oracle Transportation Management 6.5.3, an attacker could access some of your data without permission. This could lead to data leaks or privacy breaches depending on what data is stored in the system.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR or HIPAA requirements for data protection and access controls. Organizations using this software may face compliance risks if data is exposed.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Transportation Management version 6.5.3 to address the authentication vulnerability. Ensure network access controls restrict unauthorized HTTP access to the system.

Hi! I’m here to help you understand CVE-2026-60434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70