Skip to main content

Price Protection EUVDEUVD-2026-47063

| CVE-2026-60714 HIGH
Improper Access Control (CWE-284)
2026-07-21 secalert_us@oracle.com GHSA-863m-pwqp-gh34
8.1
CVSS 3.1 · Vendor: oracle
View

Vulnerability Assessment

Weakness
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Affected VersionsENISA

Oracle Price Protection 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_price_protection no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Price Protection gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive ViewAI

Why It Matters

Oracle E-Business Suite Price Protection module (versions 12.2.3-12.2.15) contains a high-severity vulnerability allowing authenticated low-privilege users to fully compromise pricing data through read, modification, and deletion. Organizations risk pricing strategy exposure, customer contract corruption, and operational disruption and must immediately inventory affected systems and restrict access while awaiting vendor remediation.

Recommended Action

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and identify those with Price Protection enabled; document network exposure paths and user populations with low-privilege credentials. Within 7 days, apply network-level access controls restricting connectivity to Price Protection systems to essential business users, disable the module in non-critical environments, and enable audit logging for all data access and modifications. Within 30 days, monitor Oracle security advisories for patch release; upon availability, test the patch in non-production environments and schedule production deployment for execution within 48 hours of validation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Implement network-level access restrictions to Price Protection systems via firewall segmentation; disable the module in non-critical Oracle E-Business Suite instances; apply role-based access controls to limit low-privilege user permissions; deploy real-time monitoring and alerting for unauthorized data access and modifications; maintain detailed audit logs for forensic investigation.

Threat Intelligence Overview

EPSS Score
0.4%
Top 71% exploitable
Data Quality
5 sources
Confidence: Medium

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy