What is the CVSS score of EUVD-2026-47138?

EUVD-2026-47138 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Price Protection are affected by EUVD-2026-47138?

Oracle E-Business Suite Price Protection module (versions 12.2.3-12.2.15) contains a local privilege-escalation vulnerability enabling any internal user with system access to read, create, delete, or…

How to fix or mitigate EUVD-2026-47138?

Within 24 hours: Identify all systems running Oracle E-Business Suite Price Protection versions 12.2.3-12.2.15 and document current local-access controls. Within 7 days: Restrict local logon to infrastructure hosting EBS to essential administrators only, implement or strengthen privileged access management (PAM) controls, and enable detailed audit logging on Price Protection data modification and access events. Within 30 days: Monitor vendor advisory channels and engage Oracle support for patch release timeline; in parallel, deploy network segmentation to isolate EBS infrastructure and implement real-time alerting for suspicious data access or bulk exports from Price Protection.

Oracle Price Protection EUVD-2026-47138

| CVE-2026-60837 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-xmxr-5hxx-256r

Authentication Bypass Privilege Escalation Oracle Price Protection

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Local logon with existing low privilege on the EBS host gives AV:L/PR:L/AC:L; high confidentiality and integrity impact with no availability effect, and cross-product impact yields S:C.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Price Protection executes to compromise Oracle Price Protection. While the vulnerability is in Oracle Price Protection, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.

Technical ContextAI

Oracle Price Protection is a Value Chain Planning / order-management module within Oracle E-Business Suite (EBS), the company's on-premises ERP platform; the affected surface sits in the 'Internal Operations' component. EBS 12.2.x is a large Java/PL-SQL application stack running on Oracle WebLogic and an Oracle Database backend, so 'accessible data' spans application and database objects reachable by the exploited context. Oracle did not assign a CWE (CWE: N/A), so the exact root-cause class is not published; the vendor tag 'Authentication Bypass' suggests an access-control or authorization weakness, but this is not corroborated by the CVSS vector, which models an already-authenticated (PR:L) local actor rather than an unauthenticated bypass.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships EBS security fixes as CPU patch bundles for the 12.2 release line rather than as a single named version, so identify and apply the specific Price Protection / EBS 12.2 patch listed in that CPU (exact patch number not enumerated in the provided data - do not substitute an invented version). Because the attack requires local logon with low privilege, high-value compensating controls until patching completes are: restrict and audit interactive/application accounts that can log on to the EBS application tier hosts, tighten Price Protection module responsibilities and menu grants to least privilege, and monitor for unauthorized data creation/deletion/modification in Price Protection tables - the trade-off is added administrative overhead and possible disruption to legitimate operators if responsibilities are over-restricted. Patch status: Patch available per vendor advisory (Oracle CPU July 2026); an exact standalone fix version was not provided in the input.