Oracle Price Protection CVE-2026-60838

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a low-privileged authenticated EBS account (CVSS PR:L), targeting the Internal Operations component of Oracle Price Protection in versions 12.2.3-12.2.15; no user interaction and no elevated privileges are needed (UI:N, AC:L, S:U). Limiting factors: the attacker must first possess valid EBS credentials of some kind, the target must be running an affected 12.2.x release, and reachability depends on whether the EBS application URLs are network-exposed to the attacker. Note the vendor 'Authentication Bypass' tag conflicts with PR:L - if a genuine unauthenticated path exists, the credential prerequisite may not hold; verify with Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high integrity impact but only partial confidentiality and no availability impact - a serious data-integrity concern rather than a full system-compromise or RCE. No EPSS score was provided, so exploitation probability cannot be quantified from the input. There is no KEV listing and no POC referenced, so the current signal set points to a real but not yet actively-exploited priority: dangerous because it is easily reachable by any authenticated EBS user, but not evidence of in-the-wild attacks. One conflict worth flagging: the vendor tag says 'Authentication Bypass,' yet the CVSS vector states PR:L (privileges required) - these are inconsistent; if a true pre-authentication bypass exists, real-world risk would be higher than PR:L implies, so verify the exact privilege prerequisite with Oracle before finalizing prioritization. No SSVC decision data was supplied.

A user holding a low-privilege but valid Oracle E-Business Suite account authenticates to the EBS web tier and sends a crafted HTTP request to the Price Protection Internal Operations functionality, exploiting the authorization weakness to modify or delete pricing/claim records they should not be able to touch and to read a subset of other Price Protection data. Because attack complexity is low and no user interaction is needed, the action can be scripted and repeated. No public POC is currently identified, so an attacker would need to develop the request themselves.