CVE-2026-60838
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Price Protection component, specifically in the Internal Operations module where it manifests as a security flaw that can be exploited by low-privileged attackers with network access through HTTP protocols. The affected versions span from 12.2.3 through 12.2.15, indicating a broad impact across multiple releases of this enterprise resource planning system. The vulnerability's classification as easily exploitable suggests that the attack vector requires minimal technical expertise and that the flaw represents a significant security weakness in Oracle's access control mechanisms.
The technical nature of this vulnerability stems from insufficient authorization checks within the Price Protection module, allowing authenticated users with minimal privileges to perform operations that should typically require higher-level permissions. This flaw enables attackers to manipulate critical data through unauthorized creation, deletion, or modification activities against all accessible data within the Price Protection component. Additionally, the vulnerability permits unauthorized read access to subsets of sensitive data that would normally be restricted to authorized personnel. The CVSS 3.1 base score of 7.1 indicates a high-severity issue with significant impacts to both confidentiality and integrity, reflecting the potential for substantial data compromise within Oracle's enterprise pricing systems.
From an operational perspective, this vulnerability poses severe risks to organizations utilizing Oracle E-Business Suite as it could lead to manipulation of pricing data that directly affects financial operations, customer billing accuracy, and competitive positioning. The unauthorized modification capabilities present particularly dangerous implications for business-critical pricing information, while the read access permissions could expose sensitive commercial data to unauthorized parties. Attackers exploiting this vulnerability could potentially disrupt pricing strategies, compromise revenue calculations, or gain insights into competitor pricing approaches through access to restricted data sets.
The security implications extend beyond immediate data compromise to include potential impacts on audit trails and compliance requirements within enterprise environments. Organizations relying on Oracle E-Business Suite for their pricing operations must consider the broader operational consequences of this vulnerability, including possible regulatory violations and financial reporting inaccuracies. The low privilege requirement makes this attack vector particularly concerning as it may be difficult to detect through standard monitoring procedures, potentially allowing attackers to maintain persistent access without immediate detection.
Mitigation strategies should prioritize immediate patching of affected Oracle E-Business Suite versions to address the authorization bypass vulnerability in the Price Protection component. Organizations should implement network segmentation and access controls to limit HTTP-based access to the vulnerable system components, while also strengthening authentication mechanisms for administrative functions. Security monitoring should be enhanced to detect unusual data access patterns or modifications within pricing-related modules. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern under ATT&CK framework's privilege escalation and credential access tactics. Given the CVSS vector indicating network accessibility with low attack complexity and limited privileges required, organizations should conduct comprehensive security assessments of their Oracle installations and consider additional defensive measures including database activity monitoring and privileged access management controls to prevent exploitation of this vulnerability across their enterprise infrastructure.