What is the CVSS score of CVE-2026-60868?

CVE-2026-60868 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-60868?

Within 24 hours, inventory all systems running Oracle E-Business Suite versions 12.2.14 through 12.2.15 and restrict network access to the Pricing Installation component to trusted internal administrative networks only. Within 7 days, contact Oracle Support for patch timeline and advisory details; implement application-level access controls limiting Pricing module access to essential personnel and enable database audit logging on all pricing tables. Within 30 days, develop a phased patching strategy prioritizing production systems upon vendor patch release, validate fixes in pre-production, and conduct access reviews to ensure only authorized users retain Pricing module permissions.

Oracle Advanced Pricing CVE-2026-60868

EUVD-2026-47157 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j756-5cm5-qrp7

Authentication Bypass Oracle Advanced Pricing

7.1

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privileged EBS user
Delivery

Reach Advanced Pricing HTTP endpoint
Exploit

Send crafted Pricing request
Execution

Satisfy high-complexity precondition
Persist

Access cross-module critical data
Impact

Perform limited unauthorized writes

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a valid low-privileged EBS account (CVSS PR:L) - it is not unauthenticated despite the 'Authentication Bypass' tag, which conflicts with the vector and should be verified with Oracle. The target must be Oracle Advanced Pricing / Pricing Installation on EBS 12.2.14-12.2.15. Limiting factors that reduce realistic risk: high attack complexity (AC:H) implying non-trivial preconditions or a race/probabilistic element the attacker must satisfy; the need for pre-existing authentication; and no required user interaction (UI:N). The scope change (S:C) is what broadens impact to additional integrated EBS products beyond Pricing.
Impact	The signals are mixed and point to a real-but-not-emergency priority. CVSS 3.1 is 7.1 (High) driven largely by the scope change and high confidentiality impact, but the attack chain is gated by AC:H (high complexity, implying specific conditions or non-deterministic steps the attacker must win) and PR:L (the attacker must already be an authenticated EBS user), which materially lowers real-world exploitability. There is no EPSS score, no POC, and no CISA KEV listing in the provided data, so there is no evidence of active or imminent mass exploitation. A conflict exists between the supplied 'Authentication Bypass' tag and the PR:L metric - if authentication could truly be bypassed the vector would be PR:N, so the tag is likely inaccurate or overbroad; treat PR:L (authenticated) as authoritative and verify with Oracle. Net: prioritize as part of normal Oracle CPU patching for internet- or partner-exposed EBS instances, above routine but below actively-exploited criticals.
Exploit ScenarioDerived	A low-privileged but legitimately authenticated Oracle E-Business Suite user (or an attacker who has phished/obtained such credentials) reaches the Advanced Pricing HTTP interface and sends specifically crafted requests that, under the right conditions, abuse the Pricing Installation flaw to read critical data across module boundaries and perform limited unauthorized inserts, updates, or deletes. The high attack complexity means the attacker may need to satisfy particular preconditions or repeat attempts, and no public exploit code is currently available to lower that bar.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Unauthorized critical-data access in Oracle Advanced Pricing (Pricing Installation component) of Oracle E-Business Suite versions 12.2.14 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the module and to make limited unauthorized inserts, updates, or deletes. Because the flaw carries a scope change, successful exploitation may significantly impact additional integrated E-Business Suite products beyond Pricing itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.1; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to affected Oracle E-Business Suite 12.2.14-12.2.15 installations; Oracle does not publish a standalone fix build number in this data, so identify the specific EBS 12.2 patch for the Advanced Pricing / Pricing Installation component from the CPU patch matrix and apply it (patch available per vendor advisory; exact fix version not independently confirmed). Until patched, reduce exposure by restricting network access to the EBS web tier so that only trusted internal users and networks can reach the Advanced Pricing HTTP endpoints (for example via URL firewall / reverse-proxy allow-listing and VPN gating), which trades off convenience for external and partner users; tighten EBS responsibility and role assignments to minimize the population of low-privileged accounts that could reach the module; and increase monitoring/auditing of Pricing-related transactions and cross-module data access. Because PR:L is required, aggressive account hygiene and session review of existing authenticated users is a meaningful compensating control while the CPU is scheduled.

Affected VersionsENISA

Oracle Advanced Pricing 12.2.14 ≤12.2.15

Affected Packages

euvd oracle_advanced_pricing no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Advanced Pricing is a pricing-engine module of the Oracle E-Business Suite (EBS) ERP platform, exposed through the EBS web tier over HTTP. The affected element is the 'Pricing Installation' component within the 12.2.x application release line. Oracle did not assign a CWE (CWE: N/A), so the exact root-cause class is not published, but the CVSS profile - network vector, high attack complexity, low privileges required, and a scope change (S:C) yielding high confidentiality and low integrity impact - is characteristic of an authorization or input-handling defect that lets an authenticated EBS user reach data and operations across a trust boundary into other EBS products. The 'Authentication Bypass' tag supplied in the intelligence conflicts with the CVSS PR:L metric (which requires the attacker to already hold low privileges) and should be treated with caution.

Know when Advanced Pricing gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI 7.1 HIGH

Network HTTP reach with an authenticated low-privileged user (PR:L) and non-trivial preconditions (AC:H); scope change to other EBS products, high confidentiality and low integrity impact, no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.14-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. While the vulnerability is in Oracle Advanced Pricing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).

Executive ViewAI

Why It Matters

Oracle Advanced Pricing in E-Business Suite versions 12.2.14-12.2.15 contains a data access vulnerability allowing low-privileged authenticated users to read and modify critical pricing data, directly threatening revenue processes and customer billing accuracy. The vulnerability's scope change creates cascade risk to integrated E-Business Suite modules beyond Pricing itself, potentially compromising dependent business systems and operational controls. Organizations using affected versions face immediate data integrity risk with no vendor patch available, requiring urgent compensating controls.

Business Impact: High

Compensating Controls

Restrict network access to Pricing Installation component to internal networks only; implement role-based access controls limiting module access to authorized administrators; enable comprehensive database audit logging for pricing table queries and modifications; require multi-factor authentication for any Pricing data access; monitor transaction logs for unauthorized insert, update, or delete operations; consider temporary suspension of non-essential Pricing modifications until patch is released.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Prevalence

Medium

widely used ERP suite, but Advanced Pricing is an optional EBS module

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.