What is the CVSS score of CVE-2026-61329?

CVE-2026-61329 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61329?

Oracle E-Business Suite Price Protection module (versions 12.2.3-12.2.15) contains an authentication bypass enabling low-privileged users to access and modify sensitive pricing data, creating…

How to fix or mitigate CVE-2026-61329?

Within 24 hours: inventory all Oracle E-Business Suite deployments running Price Protection module versions 12.2.3 through 12.2.15 and immediately restrict HTTP access to the Price Protection component to administrative users only via network controls. Within 7 days: enable comprehensive database audit logging for all Price Protection module tables and data entities; conduct forensic review of access logs for the past 30 days to identify unauthorized modification or data access activity. Within 30 days: establish monitoring for anomalous Price Protection transactions and modifications; contact Oracle for guidance on available interim fixes or extended support; prepare emergency patching procedures for immediate deployment once Oracle releases patches (expected versions 12.2.16 or later).

Oracle E-Business Suite CVE-2026-61329

EUVD-2026-47488 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3jw4-4pjj-hgjx

Authentication Bypass Oracle Price Protection

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with a required low-privileged account (PR:L) and no interaction; full read/write of module data gives C:H/I:H, no availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:52 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Price Protection (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, modify, or delete all data accessible to the Price Protection module. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication bypass; no public exploit identified at time of analysis.

Technical ContextAI

Oracle Price Protection is a supply-chain/pricing module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform, exposed through the EBS web tier over HTTP/HTTPS. The affected 'Internal Operations' component is reachable to authenticated application users, and the Oracle-supplied 'Authentication Bypass' tag suggests the flaw lets a low-privileged account exceed its intended authorization boundary to reach data it should not access. No CWE was assigned in the source data, but the behavior - a low-privileged user gaining broad read/write access to all module data - is consistent with a broken-access-control / improper-authorization root cause (CWE-284/CWE-285 class) rather than a memory-safety issue. Exact affected packages are not published as CPE strings in the provided data; Oracle scopes the impact to Price Protection deployed within EBS 12.2.3-12.2.15.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and only vendor-sanctioned remediation; the CPU is cumulative, so applying the current July 2026 EBS 12.2 patch set resolves this issue - an exact standalone fix version is not enumerated in the provided data, so consult the CPU patch matrix for the specific EBS 12.2.x bundle. Because Price Protection is reached over HTTP by low-privileged users, effective compensating controls until patching include restricting network reachability of the EBS web tier and the Price Protection responsibilities to trusted internal networks or VPN (trade-off: may block legitimate remote/partner access), tightening user-responsibility assignments so fewer accounts can reach the Internal Operations functions of Price Protection, and increasing monitoring/auditing of Price Protection data changes to detect abuse (trade-off: detective only, does not prevent exploitation). Do not treat network restriction alone as a fix since any low-privileged authenticated user on the reachable network can still exploit it.