Oracle Price Protection CVE-2026-61304

Exploitation requires a valid low-privileged account within Oracle E-Business Suite (PR:L per CVSS vector) and network access to the EBS application server via HTTP. No user interaction is needed (UI:N) and no special configuration beyond a standard EBS deployment is required. The primary limiting factor is the authenticated prerequisite: unauthenticated external attackers cannot directly exploit this vulnerability. Exploitation is further limited to the Price Protection module's data scope - broader EBS system compromise or scope escalation is not indicated (S:U). Organizations that tightly control EBS account provisioning and restrict HTTP access to trusted internal networks significantly reduce realistic exposure.

The CVSS 3.1 base score of 6.3 (Medium) reflects a low-complexity, low-privilege, network-accessible vulnerability with limited per-axis impact (C:L/I:L/A:L). The Scope is Unchanged (S:U), confining impact to the Price Protection module itself rather than enabling lateral movement into the broader EBS environment. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, meaning no confirmed active exploitation has been observed. No POC is publicly known at the time of analysis. Despite low attack complexity, the PR:L requirement meaningfully limits the attack surface to authenticated users who already hold a valid EBS account - this is a relevant limiting factor in enterprise deployments where accounts are provisioned carefully. The realistic risk is moderate: insider threats or compromised low-privilege accounts represent the credible threat model. Organizations running internet-facing EBS portals face higher exposure than those with strict internal network access controls.

An attacker with a valid low-privileged Oracle EBS account - such as a business user or a compromised service account - sends crafted HTTP requests to the Price Protection Internal Operations component over the network. By abusing insufficient authorization controls in the component, the attacker reads a subset of pricing or supplier protection data, manipulates price records or agreements, and triggers partial degradation of the service for legitimate users. No public exploit code exists, but the low attack complexity means a knowledgeable insider could develop one without specialized tooling.