CVE-2026-61304
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Price Protection. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Price Protection, a component of the Oracle E-Business Suite that manages pricing information and related operations. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial release range where this security flaw persists. The vulnerability is classified as easily exploitable, meaning that attackers with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP protocol, making it particularly concerning as it can be initiated from external networks without requiring physical access to the target system.
The technical flaw manifests as insufficient authorization controls within the internal operations of Oracle Price Protection, allowing low-privileged users to execute unauthorized actions against the system's data integrity and availability. This weakness enables attackers to perform update, insert, or delete operations on specific data sets accessible through the vulnerable component. Additionally, the vulnerability permits unauthorized read access to restricted data subsets, potentially exposing sensitive pricing information and business-critical data that should remain protected. The partial denial of service aspect means attackers can disrupt system functionality in a limited but impactful manner, affecting operational continuity and potentially causing financial losses.
The CVSS 3.1 score of 6.3 reflects the balanced severity across confidentiality, integrity, and availability impacts, with a base vector indicating network accessibility, low attack complexity, and low privilege requirements. This vulnerability aligns with CWE-285 (Improper Authorization) and relates to ATT&CK techniques including T1078 (Valid Accounts), T1566 (Phishing), and T1499 (Endpoint Development). Organizations should implement immediate mitigation strategies such as applying the latest security patches from Oracle, restricting HTTP access to authorized networks only, implementing robust network segmentation, and monitoring for unusual access patterns. The vulnerability's classification under the Common Weakness Enumeration framework emphasizes the fundamental authorization failure that allows unauthorized data manipulation and access, making it critical for enterprises to address promptly through comprehensive security controls and access management reviews.