CVE-2026-61334 in Price Protection
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Price Protection, a component of the Oracle E-Business Suite that manages pricing data and operations for enterprise environments. The affected versions span from 12.2.3 through 12.2.15, indicating a significant attack surface across multiple releases of this critical business application. The vulnerability manifests as a security flaw in the Internal Operations component, which typically handles backend processing and data management functions within the pricing module.
The technical nature of this weakness allows for unauthorized access through HTTP network connections, making it particularly dangerous as it can be exploited remotely without requiring physical system access. The CVSS 3.1 score of 7.1 indicates a high-severity vulnerability with low attack complexity and requiring only low privileges to exploit successfully. This classification aligns with CWE-284 Access Control Issues, specifically representing inadequate access controls that permit unauthorized modification and deletion of critical business data.
Attackers leveraging this vulnerability can achieve comprehensive data compromise including unauthorized creation, deletion, and modification operations against all accessible Oracle Price Protection data. Additionally, the flaw enables unauthorized read access to sensitive subsets of data within the system, potentially exposing pricing strategies, customer information, and other confidential business data. The impact extends beyond simple data corruption as it affects both confidentiality and integrity aspects of the security model according to CVSS vector analysis.
The operational implications are severe for organizations using affected Oracle E-Business Suite versions, as this vulnerability could enable financial fraud, competitive intelligence theft, or disruption of pricing operations. Organizations may face compliance violations if sensitive pricing data is exposed, particularly in regulated industries where pricing information represents proprietary business assets. The low privilege requirement makes this vulnerability particularly concerning as it can be exploited by insiders or external attackers who have gained minimal access to the network.
Mitigation strategies should include immediate patching of affected Oracle E-Business Suite versions to the latest security releases from Oracle. Network segmentation and firewall rules should limit HTTP access to only authorized administrative systems and personnel. The principle of least privilege must be enforced through proper user access controls and role-based permissions within Oracle Price Protection. Additionally, implementing robust monitoring and logging for pricing operations can help detect unauthorized modifications or access attempts. Organizations should also consider implementing database activity monitoring solutions to track changes to critical pricing tables and identify potential exploitation attempts. This vulnerability demonstrates the importance of maintaining up-to-date security patches and following the ATT&CK framework's guidance on protecting business applications from credential theft and privilege escalation attacks that target internal operations components.