CVE-2026-60837 in Price Protection
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Price Protection executes to compromise Oracle Price Protection. While the vulnerability is in Oracle Price Protection, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Price Protection, a component of the Oracle E-Business Suite that operates under the Internal Operations framework. The affected versions span from 12.2.3 through 12.2.15, representing a substantial portion of the product lifecycle where this security gap has persisted. The vulnerability's exploitability classification as easily exploitable indicates that attackers requiring minimal privileges can leverage this flaw effectively. Specifically, an attacker with mere logon credentials to the system infrastructure where Oracle Price Protection operates can compromise the entire component, demonstrating a significant privilege escalation risk.
The technical flaw manifests as insufficient access controls or authorization mechanisms within the Oracle Price Protection module, allowing unauthorized modifications to critical data structures. This weakness enables attackers to perform unauthorized creation, deletion, or modification operations against all data accessible through the vulnerable component. The scope of impact extends beyond the immediate component, as evidenced by the scope change designation indicating that successful exploitation can affect additional products within the Oracle E-Business Suite ecosystem. This interconnected impact reflects the complex integration architecture common in enterprise applications where vulnerabilities in one module can cascade across related systems.
From a security impact perspective, this vulnerability represents a critical threat vector with CVSS 3.1 base score of 8.4, indicating high severity across both confidentiality and integrity dimensions. The attack vector is local (AV:L), meaning exploitation requires physical or network access to the target system where Oracle Price Protection executes. The low attack complexity (AC:L) suggests that the exploit does not require specialized knowledge or tools beyond basic system access. The requirement for low privileged user account (PR:L) indicates that this vulnerability can be exploited by users who already have some level of access to the system infrastructure, making it particularly dangerous in environments where least privilege principles may not be strictly enforced. The scope change (S:C) component is particularly concerning as it indicates that a successful attack on Oracle Price Protection can impact additional products beyond its immediate boundaries.
The potential consequences include complete unauthorized access to critical data and full modification capabilities across all Oracle Price Protection accessible data. This represents a severe data integrity threat where attackers could manipulate pricing information, financial records, or other sensitive business data with potentially far-reaching operational impacts. The confidentiality impact is equally severe as attackers could access sensitive pricing strategies, customer information, or proprietary business data that should remain protected. Organizations using affected versions of Oracle E-Business Suite face significant operational risks including potential financial loss, regulatory compliance violations, and reputational damage from unauthorized data access or modification.
Mitigation strategies should include immediate application of Oracle's security patches and updates released for this vulnerability, as well as implementing additional access controls and monitoring mechanisms. Network segmentation and privilege restriction measures can help limit the potential impact if exploitation occurs. Organizations should also conduct comprehensive security assessments to identify all instances of affected software within their infrastructure and implement continuous monitoring for suspicious activities related to Oracle Price Protection components. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic example of insufficient authorization checks that can lead to privilege escalation attacks. This type of vulnerability commonly maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing), as attackers typically leverage existing user credentials to exploit such access control weaknesses.