What is the CVSS score of CVE-2026-60521?

CVE-2026-60521 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Oracle Advanced Pricing CVE-2026-60521

EUVD-2026-46883 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qgx4-fphm-276c

Authentication Bypass Oracle Advanced Pricing

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Authentication bypass over HTTP with no prerequisites justifies AV:N and PR:N; impacts confined to partial pricing data read/write with no availability effect yields C:L/I:L/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data as well as unauthorized read access to a subset of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthenticated remote exploitation of Oracle Advanced Pricing (E-Business Suite 12.2.3-12.2.15) via HTTP allows attackers to read and tamper with price list data without any credentials. The 'Authentication Bypass' tag and PR:N CVSS vector together confirm that the Price List component exposes sensitive pricing operations to the network without enforcing authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a straightforward target for opportunistic actors with network access to the EBS HTTP interface.

Technical ContextAI

Oracle Advanced Pricing is a module within Oracle E-Business Suite (EBS) 12.2.x responsible for managing price lists, discount schedules, and pricing formulas used in order management workflows. The affected component is the Price List interface, accessible over HTTP. The CWE classification is not specified in the available data, but the 'Authentication Bypass' tag indicates a broken access control root cause - likely an endpoint or API within the Price List component that fails to enforce session authentication before processing read or write operations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms the vulnerability is reachable over a standard network connection with no configuration complexity or credential requirement on the attacker's side.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability as part of the Oracle E-Business Suite patch bundle. The advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version within the 12.2.x release line is not independently confirmed in the available data beyond the CPU reference - consult the Oracle My Oracle Support portal for the specific patch number applicable to your EBS instance. As a compensating control prior to patching, restrict network access to the Oracle EBS HTTP interface so that only trusted internal IP ranges or authenticated VPN users can reach the application tier, which would significantly raise the bar for exploitation of this authentication bypass. Note that this control does not eliminate the vulnerability and must not substitute for patching.