What is the CVSS score of CVE-2026-60835?

CVE-2026-60835 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle Price Protection CVE-2026-60835

EUVD-2026-47136 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-fvqc-7h35-7mrg

Authentication Bypass Information Disclosure Oracle Price Protection

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP access with low privilege aligns with vendor vector; confidentiality-only impact confirmed; no integrity or availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:45 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.

Technical ContextAI

Oracle Price Protection is a module within Oracle E-Business Suite (EBS) responsible for managing price protection agreements, supplier pricing credits, and related commercial workflows. The affected component is 'Internal Operations,' which handles business logic processing within the module. The vulnerability is tagged 'Authentication Bypass,' indicating the root cause likely involves improper authorization enforcement - a session operating at low privilege level can invoke Internal Operations endpoints or APIs that should be restricted to higher-privilege roles, resulting in unauthorized data exposure. No CWE has been formally assigned by NVD, but the pattern aligns with CWE-285 (Improper Authorization) or CWE-862 (Missing Authorization). The attack vector is HTTP over the network, consistent with Oracle EBS's web-tier architecture (Oracle Application Framework / Forms).

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability; the advisory is at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed from the available data - consult the CPU advisory for the precise patch set or bundle required for each supported E-Business Suite release between 12.2.3 and 12.2.15. As a compensating control prior to patching, restrict network access to Oracle EBS Internal Operations endpoints at the application server or network firewall layer, limiting connectivity to only trusted IP ranges or VPN-connected users. Additionally, review and tighten EBS role assignments for the Price Protection module, revoking access from users who do not require it - this reduces the pool of accounts that could be used to trigger the bypass. Note that restricting network access affects all EBS users and may disrupt legitimate workflows; coordinate with application owners before implementing.