What is the CVSS score of CVE-2026-60863?

CVE-2026-60863 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-60863?

Within 24 hours, audit systems running Oracle EBS 12.2.3-12.2.15 to identify which instances have Advanced Pricing active and document their network exposure. Within 7 days, implement compensating controls: restrict HTTP/HTTPS access to the Advanced Pricing module to administrative networks only, require VPN access for all users, and enforce multi-factor authentication for Advanced Pricing administrative accounts. Within 30 days, establish a remediation roadmap: evaluate upgrade options to EBS 12.2.16 or later (when patch releases), monitor Oracle security advisories for availability of a security patch, and prepare either an upgrade or a network segmentation strategy to isolate Advanced Pricing from untrusted networks.

Oracle Advanced Pricing CVE-2026-60863

EUVD-2026-47154 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-gvr3-fpv7-q3fc

Privilege Escalation Oracle Advanced Pricing

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged EBS account
Delivery

Reach Advanced Pricing HTTP endpoint
Exploit

Send crafted pricing/installation request
Execution

Exploit access-control/injection flaw
Persist

Take over Advanced Pricing module
Impact

Read/alter pricing data, disrupt service

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a valid low-privileged EBS application account (CVSS PR:L - authenticated), targeting the Advanced Pricing 'Pricing Installation' component on EBS 12.2.3 through 12.2.15; no user interaction and no elevated/admin privileges are needed (UI:N, AC:L), and the scope is unchanged (S:U). Limiting factors: the attacker must first obtain some authenticated foothold in EBS, and the endpoint must be reachable - instances whose pricing URLs are blocked at the DMZ/reverse proxy or restricted to internal networks materially reduce exposure. Only EBS 12.2 (12.2.3-12.2.15) is stated as affected.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with full impact - a genuine priority for internet-exposed or widely-accessed EBS instances. However, no EPSS score, POC, or KEV signal is present in the provided data, so predicted exploitation probability and confirmed in-the-wild use are both currently unknown; the score is high but real-world exploitation evidence is absent at analysis time. The 'Information Disclosure' tag is narrower than the vector's full-takeover claim (C:H/I:H/A:H), a mild inconsistency likely reflecting incomplete tagging rather than reduced impact - treat the CVSS takeover characterization as authoritative. Prioritization should weight the fact that EBS pricing endpoints typically sit behind authentication, so PR:L means a valid (even minimal) application account is a real prerequisite that limits fully anonymous mass exploitation.
Exploit ScenarioDerived	An attacker who holds (or phishes/brute-forces) any low-privilege Oracle EBS application account sends crafted HTTP requests to the Advanced Pricing / Pricing Installation endpoint over the network, requiring no user interaction and only low attack complexity. By abusing the flaw they escalate to full control of the Advanced Pricing module - reading and altering pricing data and disrupting the service. No public proof-of-concept is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-recommended remediation for all affected EBS 12.2.3-12.2.15 deployments; Oracle ships EBS security fixes as consolidated CPU patches rather than a single renamed product version, so identify and apply the specific EBS 12.2 patch referenced for Advanced Pricing in that CPU (Patch available per vendor advisory - an independently confirmed standalone fix version is not provided in this data). Until patching, reduce exposure by ensuring the EBS web tier and Advanced Pricing endpoints are not reachable from untrusted networks - restrict access to the pricing/installation URLs via reverse-proxy or URL firewall (Oracle's DMZ URL allowlist / mod_security rules), and tighten which application accounts hold pricing privileges since exploitation requires a low-privileged authenticated session; note that URL restrictions can break legitimate integrations or self-service pricing flows and should be validated against business processes before enforcement.

Affected VersionsENISA

Oracle Advanced Pricing 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_advanced_pricing no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Advanced Pricing is a pricing-engine module within Oracle E-Business Suite (EBS) 12.2, the vendor's on-premises/hosted ERP platform, exposed through the EBS web tier (Oracle HTTP Server / WebLogic front end) reachable over HTTP. The affected 'Pricing Installation' component handles setup and installation logic for the pricing subsystem. Oracle did not assign a CWE (CWE: N/A) and the advisory does not disclose the specific weakness class; the combination of network HTTP vector, low required privilege, and full C/I/A takeover is consistent with common EBS flaws such as authenticated injection or broken access control in a servlet/JSP endpoint, but the precise root cause is not published by Oracle in the CPU summary.

Know when Advanced Pricing gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network HTTP reach and easy exploitation give AV:N/AC:L; a low-privilege EBS account is required (PR:L); stated full takeover yields C:H/I:H/A:H, matching Oracle's vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Pricing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite Advanced Pricing (releases 12.2.3-12.2.15) is vulnerable to complete compromise by low-privileged authenticated users, exposing price data, configuration, and system operations. This vulnerability directly threatens organizations' pricing logic and revenue operations, as attackers can manipulate, exfiltrate, or disrupt the pricing module without higher-level system access.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Advanced Pricing module via firewall rules (HTTP/HTTPS only from admin networks), enforce multi-factor authentication for all Pricing module users, implement detailed audit logging of Pricing module access and configuration changes, and consider network segmentation to isolate EBS instances from general corporate networks.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

High

Oracle EBS is widely deployed enterprise ERP; Advanced Pricing is a common EBS module

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.