CVE-2026-60868 in Advanced Pricing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.14-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. While the vulnerability is in Oracle Advanced Pricing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Advanced Pricing, a critical component of the Oracle E-Business Suite that governs pricing calculations and configurations across enterprise environments. The affected versions spanning 12.2.14 through 12.2.15 represent a significant attack surface given their widespread deployment in enterprise infrastructure. The vulnerability's classification as difficult to exploit indicates that while sophisticated attack techniques are required, the potential impact remains severe enough to warrant immediate attention from security professionals.
The technical flaw manifests as an insufficient access control mechanism within the pricing installation component, allowing low-privileged attackers with network-level access through HTTP protocols to gain unauthorized access to sensitive pricing data. This represents a classic privilege escalation vulnerability where minimal authentication credentials can be leveraged to achieve substantial data compromise. The CVSS 3.1 score of 7.1 reflects the moderate complexity required for exploitation combined with high impact potential, particularly given that this vulnerability affects not only Oracle Advanced Pricing but can also cause scope changes impacting additional products within the Oracle E-Business Suite ecosystem.
The operational impact extends beyond simple data access violations to include complete compromise of pricing configurations and associated financial data that organizations rely upon for business operations. Attackers could potentially modify pricing rules, manipulate product costs, or alter discount structures that directly affect revenue streams and customer billing accuracy. The confidentiality impact rated as high indicates that sensitive pricing strategies, competitor information, and proprietary pricing models could be exposed to unauthorized parties. Integrity impacts are also significant as attackers could introduce malicious pricing modifications that would propagate throughout the enterprise pricing system.
From an attacker perspective, this vulnerability aligns with ATT&CK technique T1213.002 (Data from Information Repositories) and represents a common vector for credential theft and data exfiltration within enterprise environments. The scope change aspect indicates that initial compromise of Oracle Advanced Pricing could enable lateral movement to other interconnected Oracle applications within the same suite, potentially amplifying the attack impact exponentially. Organizations should consider implementing network segmentation controls and restricting HTTP access to privileged administrative interfaces.
Recommended mitigations include immediate patching of affected Oracle E-Business Suite versions to the latest security releases, implementation of network-based access controls to limit HTTP access to pricing components, and deployment of web application firewalls to monitor and filter malicious requests targeting the vulnerable pricing installation functionality. The vulnerability's characteristics suggest that organizations should also conduct comprehensive access control reviews and implement principle of least privilege configurations for all Oracle Advanced Pricing interfaces. Additionally, monitoring for unusual pricing data modifications or unauthorized access attempts should be implemented as part of ongoing security operations to detect potential exploitation attempts.
This vulnerability demonstrates the critical importance of maintaining up-to-date security patches in enterprise ERP environments where multiple interconnected applications create complex attack surfaces. The combination of network accessibility and the ability to compromise both confidentiality and integrity aspects makes this a particularly dangerous vulnerability that organizations must address immediately through coordinated patch management and access control hardening measures.