CVE-2026-60521 in Advanced Pricing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data as well as unauthorized read access to a subset of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Advanced Pricing, a critical component of the Oracle E-Business Suite ecosystem that manages pricing strategies and product valuation systems. The affected version range spans from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple releases of the enterprise suite. The vulnerability manifests as an authentication bypass flaw that allows unauthenticated attackers to exploit network-based HTTP interfaces without requiring valid credentials or prior access privileges. This represents a significant security weakness that directly undermines the foundational security controls designed to protect enterprise pricing data and business-critical financial information.
The technical exploitation of this vulnerability enables attackers to perform unauthorized operations against Oracle Advanced Pricing data structures through HTTP protocols. Specifically, successful exploitation grants malicious actors the ability to modify existing pricing data through update operations, introduce new pricing entries via insert functions, or remove existing price list information through delete commands. Additionally, attackers can access sensitive pricing data that should remain restricted to authorized personnel, creating potential for competitive intelligence theft and financial manipulation. The CVSS 3.1 scoring of 6.5 reflects the moderate severity of this flaw, with a base score indicating low attack complexity and no privileges required, while the impact assessment shows both confidentiality and integrity violations that align with CWE-287 (Improper Authentication) and CWE-20 (Improper Input Validation).
From an operational perspective, this vulnerability poses substantial risk to enterprise environments relying on Oracle E-Business Suite for pricing management and revenue optimization. The unauthorized read access to pricing data can expose sensitive commercial information including cost structures, margin calculations, competitor pricing strategies, and customer-specific pricing agreements that directly impact business competitiveness and financial integrity. The unauthorized modification capabilities create potential for revenue loss through price manipulation or the introduction of erroneous pricing that could affect billing systems and customer relationships. Organizations utilizing this software component face significant exposure to both internal and external threat actors who may exploit this weakness to gain competitive advantages or cause financial disruption.
The attack surface extends beyond simple network access requirements, as HTTP-based exploitation means that any system with exposed Oracle Advanced Pricing interfaces can be targeted without requiring physical access or complex authentication bypass techniques. This vulnerability aligns with ATT&CK technique T1190 (Exploit Public-Facing Application) and demonstrates the critical importance of securing enterprise application interfaces. Organizations should implement immediate network segmentation controls to restrict access to Oracle Advanced Pricing components, deploy web application firewalls to monitor and filter HTTP traffic, and ensure that all exposed interfaces are properly patched and updated. The vulnerability also highlights the necessity of regular security assessments and continuous monitoring for similar authentication bypass flaws within enterprise application environments, particularly in complex ERP systems where multiple interconnected components may present additional attack vectors through the principle of least privilege enforcement.