What is the CVSS score of CVE-2026-60838?

CVE-2026-60838 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Price Protection are affected by CVE-2026-60838?

Oracle Price Protection in E-Business Suite versions 12.2.3-12.2.15 contains a data tampering vulnerability that allows low-privileged authenticated users to modify or delete critical pricing data,…

How to fix or mitigate CVE-2026-60838?

Within 24 hours, identify and document all Oracle EBS systems running versions 12.2.3 through 12.2.15, and enumerate current user access to Price Protection modules. Within 7 days, apply compensating controls: restrict Price Protection module access to essential users only, enable database audit logging on all Price Protection tables with alerts for modifications, and implement mandatory change approval workflows for pricing transactions. Within 30 days, confirm patch status with Oracle Support, plan system upgrades to Oracle EBS 12.2.16 or later (pending patch release), and conduct a full access review to remove unnecessary Price Protection permissions from all user accounts.

Oracle Price Protection CVE-2026-60838

EUVD-2026-47139 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6xm5-v767-43rp

Authentication Bypass Oracle Price Protection

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (oracle) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network-reachable HTTP with a required low-privilege EBS account gives AV:N/AC:L/PR:L/UI:N; high data-tampering impact is I:H, limited read is C:L, and no availability effect is A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:52 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionNVD

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with an authenticated HTTP session to create, delete, or modify critical application data and read a subset of Price Protection data. The CVSS 3.1 base score is 7.1, driven primarily by high integrity impact (I:H) with limited confidentiality exposure (C:L) and no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Price Protection is a module within the Oracle E-Business Suite (EBS) applications stack, used to manage supplier price protection claims and pricing adjustments in supply-chain and channel-management workflows. The flaw resides in the Internal Operations component and is reached over HTTP through the EBS web tier, meaning any user who can authenticate to the EBS environment is positioned to reach the vulnerable functionality. No CWE was assigned in the source data, but the impact profile (integrity-dominant, network-exposed, low-privilege) combined with the vendor-supplied 'Authentication Bypass' tag is consistent with a broken-access-control / authorization weakness (CWE-285 class) where an authenticated user can act on data or functions beyond their intended privilege level rather than a memory-corruption or injection bug.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle addresses this class of EBS issue through the quarterly CPU patch bundle rather than a standalone version number, so administrators should apply the July 2026 CPU patch for their E-Business Suite 12.2.x release line; no discrete fixed version string was published in the available data (Patch available per vendor advisory). As compensating controls until the CPU is applied, restrict network access to the EBS web tier so the Price Protection module is not broadly reachable (for example limit HTTP access to the application URLs to trusted internal networks or VPN), tighten EBS user responsibilities and role grants so only genuinely required users hold Price Protection access, and increase monitoring/audit logging of create/modify/delete actions on Price Protection data to detect abuse; the trade-off of access restriction is potential disruption to legitimate remote or partner users, and role tightening requires validation against business workflows to avoid breaking authorized operations.