Description
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data as well as unauthorized read access to a subset of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Advanced Pricing arises from a CWE-284 weakness – improper access control – where the application fails to enforce proper authorization checks. As a result, an unauthenticated attacker with network access via HTTP can modify, insert or delete data and read a subset of accessible data, leading to confidentiality and integrity impacts. The flaw yields a CVSS 3.1 base score of 6.5, indicating medium severity.

Affected Systems

Oracle Advanced Pricing components of Oracle E‑Business Suite, specifically the Price List module, are impacted for versions 12.2.3 through 12.2.15.

Risk and Exploitability

The vulnerability is explo via a network‑based HTTP request without authentication, implying that any host on the public or internal network could potentially trigger it. The EPSS score of less than 1% indicates that exploitation probability is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Despite the low likelihood, the potential for unauthorized data modification and disclosure warrants monitoring and remediation.

Generated by OpenCVE AI on August 2, 2026 at 22:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Advanced Pricing patch or update to a fixed version for 12.2.3–12.2.15
  • Limit HTTP access to the Advanced Pricing servers to trusted networks and implement strong authentication and authorization controls
  • Audit and monitor database changes and access logs for anomalous activity to detect potential exploitation

Generated by OpenCVE AI on August 2, 2026 at 22:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leads to Unauthorized Data Modification and Disclosure in Oracle Advanced Pricing

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leads to Unauthorized Data Modification and Disclosure in Oracle Advanced Pricing
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Pricing accessible data as well as unauthorized read access to a subset of Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle advanced Pricing
CPEs cpe:2.3:a:oracle:advanced_pricing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle advanced Pricing
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Advanced Pricing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T18:14:19.245Z

Reserved: 2026-07-08T15:51:40.542Z

Link: CVE-2026-60521

cve-icon Vulnrichment

Updated: 2026-07-24T18:14:13.559Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T22:15:03Z

Weaknesses