CVE-2026-60870 in Advanced Pricing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Advanced Pricing, a critical component of the Oracle E-Business Suite that governs pricing calculations and product valuation processes across enterprise environments. The flaw exists in the Pricing Installation module and affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, representing a substantial attack surface given the widespread adoption of these suite versions across global enterprises. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise to leverage this weakness, making it particularly dangerous for organizations with insufficient security controls in place.
The technical nature of this vulnerability allows a low-privileged attacker to execute successful attacks through HTTP network connections, eliminating the need for physical access or elevated privileges within the target environment. This attack vector aligns with common web application exploitation techniques and represents a significant weakness in the authentication and authorization mechanisms of Oracle Advanced Pricing. The CVSS 3.1 score of 7.1 reflects the severity of impact across multiple dimensions, with high confidentiality impact indicating potential exposure of sensitive pricing data, and low integrity impact suggesting modifications to data without full system compromise.
The operational consequences of successful exploitation extend beyond simple data theft, as attackers can achieve complete access to all Oracle Advanced Pricing accessible data while also gaining unauthorized update, insert, or delete capabilities for certain data sets. This dual impact capability creates substantial business disruption potential, particularly in manufacturing and retail environments where pricing accuracy directly affects revenue streams and competitive positioning. The vulnerability's ability to compromise critical data integrity means that attackers could manipulate pricing information to gain financial advantage or disrupt normal business operations.
Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to Oracle Advanced Pricing components, deployment of web application firewalls to monitor and filter malicious traffic patterns, and comprehensive access controls to ensure only authorized personnel can interact with pricing systems. The vulnerability demonstrates the importance of maintaining current patch levels and implementing proper security monitoring for enterprise applications. According to CWE standards, this represents a weakness in authorization mechanisms that falls under CWE-285, while ATT&CK framework categorizes this as a privilege escalation technique through network-based exploitation methods. Regular vulnerability assessments and security audits should be conducted to identify similar weaknesses in other Oracle E-Business Suite components and ensure comprehensive protection against similar attack vectors.