What is the CVSS score of CVE-2026-61334?

CVE-2026-61334 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Price Protection are affected by CVE-2026-61334?

Oracle Price Protection in E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability allowing low-privileged attackers to modify critical pricing data and access sensitive information,…

How to fix or mitigate CVE-2026-61334?

Within 24 hours: Inventory all systems running Oracle EBS Price Protection versions 12.2.3-12.2.15 and restrict HTTP network access to the affected module through firewall rules or network segmentation to low-trust zones. Within 7 days: Implement enhanced access controls limiting Price Protection modifications to high-privilege users only, deploy monitoring and alerting for unauthorized price data changes, and review access logs for suspicious activity dating back 30 days. Within 30 days: Monitor Oracle's advisory channels for patch release, develop a change control procedure for deployment when available, and escalate a formal support case to Oracle requesting an expedited patch timeline if none has been provided.

Oracle Price Protection CVE-2026-61334

EUVD-2026-47490 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rrgj-3965-m8p6

Authentication Bypass Oracle Price Protection

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network HTTP reachable with low complexity, requires an authenticated low-privileged account (PR:L); high integrity and low confidentiality impact, no availability effect, matching Oracle's data-tampering description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:52 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized read access to a subset of Oracle Price Protection accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering and information disclosure in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access create, delete, or modify critical Price Protection data and read a subset of accessible data. The flaw carries a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided.

Technical ContextAI

Oracle Price Protection is a module within the Oracle E-Business Suite (EBS), a large integrated ERP/CRM platform typically deployed as a web-facing application tier (Oracle Application Server / WebLogic) fronting an Oracle Database. The affected 'Internal Operations' component is reachable over HTTP, so exposure occurs through the EBS application front end rather than via direct database access. No CWE was assigned by Oracle or NVD, so the precise root-cause class is unconfirmed; however, the CVSS profile - network vector, low privileges required, high integrity impact, limited confidentiality impact, and no availability impact - is consistent with a broken access-control or authorization flaw that allows an authenticated user to act on data beyond their intended scope. The supplied 'Authentication Bypass' tag conflicts with the CVSS PR:L metric (which requires some authentication), so that tag should be treated as unverified.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory, though the input does not specify an exact patched build number, so select the correct EBS 12.2 patch for your release from the CPU matrix. As compensating controls until patching, restrict network reachability of the Oracle Price Protection / Internal Operations functionality to trusted internal users (for example via reverse-proxy or WebLogic access rules, and by not exposing the EBS application tier to the internet), tighten responsibility and role assignments so low-privileged accounts cannot reach Price Protection functions, and increase auditing/monitoring of Price Protection data changes to detect unauthorized create/delete/modify activity - noting that access restrictions may disrupt legitimate remote users and that monitoring is detective rather than preventive.