What is the CVSS score of CVE-2026-61304?

CVE-2026-61304 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Price Protection CVE-2026-61304

EUVD-2026-47473 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gcjg-52hj-8vjr

Authentication Bypass Denial Of Service Oracle Price Protection

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable via HTTP with low privileges required; no user interaction; limited partial impact across all three CIA axes with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Price Protection. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Price Protection is a module within Oracle E-Business Suite (EBS) responsible for managing promotional pricing, price adjustments, and supplier price protection agreements, typically deployed in retail and manufacturing enterprise environments. The affected component is 'Internal Operations,' which handles backend processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms the vulnerability is reachable over HTTP without elevated privileges and requires no special configuration or user interaction. No CWE was assigned, preventing precise root-cause classification; the flaw's nature - affecting data reads, writes, and partial availability - is consistent with improper authorization or access control weaknesses within the internal processing layer. Supported versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's advisory.

RemediationAI

Apply the patches released by Oracle in the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish patch version numbers independently of the CPU; administrators should log into My Oracle Support and apply the relevant CPU patch bundle for the installed EBS version (12.2.3-12.2.15). As a compensating control prior to patching, restrict network access to the Oracle Price Protection Internal Operations component by enforcing network-level access controls (firewall rules or EBS function security profiles) to limit which roles or IP ranges can invoke the affected component. Auditing EBS user accounts with access to Price Protection to ensure least-privilege principles are enforced will reduce the pool of potential attackers. Note: restricting HTTP access to EBS broadly may impact legitimate business operations and should be scoped narrowly.