What is the CVSS score of EUVD-2026-47157?

EUVD-2026-47157 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Advanced Pricing are affected by EUVD-2026-47157?

Oracle Advanced Pricing in E-Business Suite versions 12.2.14-12.2.15 contains a data access vulnerability allowing low-privileged authenticated users to read and modify critical pricing data,…

How to fix or mitigate EUVD-2026-47157?

Within 24 hours, inventory all systems running Oracle E-Business Suite versions 12.2.14 through 12.2.15 and restrict network access to the Pricing Installation component to trusted internal administrative networks only. Within 7 days, contact Oracle Support for patch timeline and advisory details; implement application-level access controls limiting Pricing module access to essential personnel and enable database audit logging on all pricing tables. Within 30 days, develop a phased patching strategy prioritizing production systems upon vendor patch release, validate fixes in pre-production, and conduct access reviews to ensure only authorized users retain Pricing module permissions.

Oracle Advanced Pricing EUVD-2026-47157

| CVE-2026-60868 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j756-5cm5-qrp7

Authentication Bypass Oracle Advanced Pricing

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP reach with an authenticated low-privileged user (PR:L) and non-trivial preconditions (AC:H); scope change to other EBS products, high confidentiality and low integrity impact, no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.14-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. While the vulnerability is in Oracle Advanced Pricing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized critical-data access in Oracle Advanced Pricing (Pricing Installation component) of Oracle E-Business Suite versions 12.2.14 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the module and to make limited unauthorized inserts, updates, or deletes. Because the flaw carries a scope change, successful exploitation may significantly impact additional integrated E-Business Suite products beyond Pricing itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.1; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Advanced Pricing is a pricing-engine module of the Oracle E-Business Suite (EBS) ERP platform, exposed through the EBS web tier over HTTP. The affected element is the 'Pricing Installation' component within the 12.2.x application release line. Oracle did not assign a CWE (CWE: N/A), so the exact root-cause class is not published, but the CVSS profile - network vector, high attack complexity, low privileges required, and a scope change (S:C) yielding high confidentiality and low integrity impact - is characteristic of an authorization or input-handling defect that lets an authenticated EBS user reach data and operations across a trust boundary into other EBS products. The 'Authentication Bypass' tag supplied in the intelligence conflicts with the CVSS PR:L metric (which requires the attacker to already hold low privileges) and should be treated with caution.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to affected Oracle E-Business Suite 12.2.14-12.2.15 installations; Oracle does not publish a standalone fix build number in this data, so identify the specific EBS 12.2 patch for the Advanced Pricing / Pricing Installation component from the CPU patch matrix and apply it (patch available per vendor advisory; exact fix version not independently confirmed). Until patched, reduce exposure by restricting network access to the EBS web tier so that only trusted internal users and networks can reach the Advanced Pricing HTTP endpoints (for example via URL firewall / reverse-proxy allow-listing and VPN gating), which trades off convenience for external and partner users; tighten EBS responsibility and role assignments to minimize the population of low-privileged accounts that could reach the module; and increase monitoring/auditing of Pricing-related transactions and cross-module data access. Because PR:L is required, aggressive account hygiene and session review of existing authenticated users is a meaningful compensating control while the CPU is scheduled.