Oracle Price Protection CVE-2026-60837

The attacker must already have low-privileged logon access to the infrastructure where Oracle Price Protection executes (AV:L, PR:L) - i.e., a valid account or shell on the EBS application-tier host, not merely network reachability - and the target must be running Oracle Price Protection on E-Business Suite 12.2.3-12.2.15. No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors that reduce realistic risk: exploitation is local rather than remote-network, and it presupposes an existing authenticated foothold, making this primarily an insider or post-compromise privilege/data-access escalation rather than a directly internet-exploitable flaw. Caveat: the vendor 'Authentication Bypass' tag hints access controls could be circumvented, which would relax these conditions - confirm against Oracle's advisory before relying on the authenticated prerequisite.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 8.4) describes a locally-accessible, low-complexity flaw requiring existing low-level privileges and no user interaction, with high confidentiality and integrity impact and a scope change that reaches other products - but no availability impact. The local attack vector (AV:L) and the requirement for valid low-privileged logon materially reduce real-world exposure compared to a network-facing unauthenticated bug, favoring insider or post-foothold abuse over mass exploitation. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input. Note a conflict to verify: the vendor tag says 'Authentication Bypass,' which implies pre-auth access, yet the CVSS vector encodes PR:L (authenticated) - treat the 'bypass' framing with caution until Oracle's advisory text is reviewed. Net: a genuine high-severity issue for organizations running EBS, but the local-plus-authenticated prerequisite makes it a prioritize-but-not-emergency item absent evidence of active exploitation.

A user holding a low-privilege application account or local shell on the Oracle EBS server abuses the Price Protection flaw to escalate their reach, reading and altering critical Price Protection data - for example, tampering with price-protection claims or pricing records - and, thanks to the scope change, pivoting to affect other EBS products. No user interaction or elevated privileges are needed and complexity is low, so the action is straightforward once local access exists; no public exploit identified at time of analysis.