What is the CVSS score of CVE-2026-60870?

CVE-2026-60870 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Advanced Pricing are affected by CVE-2026-60870?

Oracle Advanced Pricing in E-Business Suite versions 12.2.3-12.2.15 allows low-privileged users to access and modify pricing records over HTTP without proper authorization, creating revenue data and…

How to fix or mitigate CVE-2026-60870?

Within 24 hours, inventory all Oracle E-Business Suite deployments and identify systems running versions 12.2.3 through 12.2.15 with the Advanced Pricing module enabled; assess network exposure and document existing low-privileged user accounts with Pricing access. Within 7 days, implement network segmentation to restrict HTTP access to the Pricing Installation component to authorized administrative systems, enforce principle of least privilege by disabling unnecessary low-privileged pricing module access, and deploy Web Application Firewall (WAF) rules to monitor pricing data endpoints. Within 30 days, establish weekly monitoring of Oracle advisory channels for patch availability; prepare and test an upgrade path to a patched E-Business Suite version; enable comprehensive audit logging for all pricing data read and write operations as a permanent compensating control.

Oracle Advanced Pricing CVE-2026-60870

EUVD-2026-47158 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5976-rxr7-7x7c

Authentication Bypass Oracle Advanced Pricing

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP access with a required low-privilege EBS account gives AV:N/AC:L/PR:L/UI:N; full module data read is C:H, partial writes I:L, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access and partial data manipulation in Oracle Advanced Pricing (the Pricing Installation component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access over HTTP to read all data accessible to the module and to insert, update, or delete some of it. The flaw is rated CVSS 3.1 7.1 (High) with high confidentiality impact and low integrity impact; Oracle disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS pricing modules are attractive targets in enterprise ERP environments.

Technical ContextAI

Oracle Advanced Pricing is a pricing-engine module within Oracle E-Business Suite (EBS) 12.2.x, the on-premise Oracle ERP platform, and the affected surface is the 'Pricing Installation' component exposed over HTTP through the EBS application tier (Oracle Application Server / WebLogic front end). Because the CVSS vector is AV:N/AC:L/PR:L, exploitation occurs through the web-facing EBS interface by an actor holding at least a low-privilege EBS application account. No CWE was assigned by NVD (CWE: N/A), so the precise root-cause class is not formally categorized; the vendor-supplied 'Authentication Bypass' tag combined with PR:L and high confidentiality impact suggests a horizontal access-control / authorization weakness that lets a low-privileged session reach pricing data it should not, rather than a fully unauthenticated bypass. The S:U (scope unchanged) flag indicates impact is confined to the Advanced Pricing module and its accessible data, not the wider host.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers mapped to your EBS 12.2.x level) - no discrete fixed build string beyond the CPU is given in the source data, so identify the correct patch for your installed 12.2.3-12.2.15 release from the CPU matrix. Because exploitation needs a low-privilege authenticated EBS account, compensating controls until patching include tightening EBS user provisioning and reviewing responsibilities/roles that grant access to the Advanced Pricing (QP) module, restricting network reachability of the EBS application tier to trusted internal users or VPN (trade-off: may impede legitimate remote self-service users), and enabling and monitoring EBS audit logging on pricing data for anomalous read/insert/update/delete activity (trade-off: added log volume but no functional impact). Rotate or disable dormant low-privilege accounts that could be abused as the required foothold.