Oracle Price Protection CVE-2026-61334

Exploitation requires network HTTP access to the Oracle E-Business Suite application tier hosting the Oracle Price Protection Internal Operations component, plus a valid low-privileged account (CVSS PR:L) - it is not anonymous or unauthenticated despite the 'Authentication Bypass' tag, which is unconfirmed and contradicts the vector. Affected deployments are EBS 12.2.3 through 12.2.15. No user interaction, no special client-side conditions, and no non-default configuration are indicated; the principal limiting factors are the need for prior authentication and network reachability of the EBS front end, so environments that keep the application tier internal-only and enforce least-privilege responsibilities materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) indicates a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, with primary damage being high integrity impact (data creation/deletion/modification) plus limited confidentiality exposure and no availability effect. Because PR:L is required, this is an authenticated attack - any legitimate low-privileged EBS/Price Protection account, or a compromised set of such credentials, is the realistic launch point, making this more of an insider/credential-abuse threat than a fully anonymous internet attack. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code at time of analysis, placing this as a genuine but not emergency-priority integrity issue. Two gaps must be flagged: CWE is N/A (root cause unconfirmed), and the 'Authentication Bypass' tag directly contradicts the PR:L vector - verify with Oracle before treating exploitation as unauthenticated.

A low-privileged user who already holds a valid Oracle E-Business Suite account, or an attacker who has phished or otherwise compromised such credentials, sends crafted HTTP requests to the Price Protection Internal Operations interface and manipulates records they should not be able to touch - creating, altering, or deleting critical pricing data and reading a subset of otherwise restricted data. Low attack complexity and no user-interaction requirement make the action straightforward once authenticated, though no public exploit code is currently known.