What is the CVSS score of CVE-2026-60863?

CVE-2026-60863 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Advanced Pricing are affected by CVE-2026-60863?

Oracle E-Business Suite Advanced Pricing (releases 12.2.3-12.2.15) is vulnerable to complete compromise by low-privileged authenticated users, exposing price data, configuration, and system…

How to fix or mitigate CVE-2026-60863?

Within 24 hours, audit systems running Oracle EBS 12.2.3-12.2.15 to identify which instances have Advanced Pricing active and document their network exposure. Within 7 days, implement compensating controls: restrict HTTP/HTTPS access to the Advanced Pricing module to administrative networks only, require VPN access for all users, and enforce multi-factor authentication for Advanced Pricing administrative accounts. Within 30 days, establish a remediation roadmap: evaluate upgrade options to EBS 12.2.16 or later (when patch releases), monitor Oracle security advisories for availability of a security patch, and prepare either an upgrade or a network segmentation strategy to isolate Advanced Pricing from untrusted networks.

Oracle Advanced Pricing CVE-2026-60863

EUVD-2026-47154 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-gvr3-fpv7-q3fc

Privilege Escalation Oracle Advanced Pricing

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach and easy exploitation give AV:N/AC:L; a low-privilege EBS account is required (PR:L); stated full takeover yields C:H/I:H/A:H, matching Oracle's vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Pricing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Advanced Pricing is a pricing-engine module within Oracle E-Business Suite (EBS) 12.2, the vendor's on-premises/hosted ERP platform, exposed through the EBS web tier (Oracle HTTP Server / WebLogic front end) reachable over HTTP. The affected 'Pricing Installation' component handles setup and installation logic for the pricing subsystem. Oracle did not assign a CWE (CWE: N/A) and the advisory does not disclose the specific weakness class; the combination of network HTTP vector, low required privilege, and full C/I/A takeover is consistent with common EBS flaws such as authenticated injection or broken access control in a servlet/JSP endpoint, but the precise root cause is not published by Oracle in the CPU summary.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-recommended remediation for all affected EBS 12.2.3-12.2.15 deployments; Oracle ships EBS security fixes as consolidated CPU patches rather than a single renamed product version, so identify and apply the specific EBS 12.2 patch referenced for Advanced Pricing in that CPU (Patch available per vendor advisory - an independently confirmed standalone fix version is not provided in this data). Until patching, reduce exposure by ensuring the EBS web tier and Advanced Pricing endpoints are not reachable from untrusted networks - restrict access to the pricing/installation URLs via reverse-proxy or URL firewall (Oracle's DMZ URL allowlist / mod_security rules), and tighten which application accounts hold pricing privileges since exploitation requires a low-privileged authenticated session; note that URL restrictions can break legitimate integrations or self-service pricing flows and should be validated against business processes before enforcement.