Description
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Pricing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits an attacker with limited privileges who can reach the system over HTTP to compromise the Oracle Advanced Pricing service, potentially leading to full control of pricing operations. The stated CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the flaw has severe confidentiality, integrity, and availability impacts when successfully exploited.

Affected Systems

Oracle Advanced Pricing, a component of Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are affected. Any system running these releases and exposed to network traffic on HTTP is vulnerable.

Risk and Exploitability

With a CVSS base score of 8.8 the vulnerability is considered high risk. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the product is not listed in the CISA KEV catalog. However, because the attack does not require user interaction and requires only low privileges, a vulnerable system that is reachable over the network can be compromised remotely, which elevates the overall threat level for exposed environments.

Generated by OpenCVE AI on August 4, 2026 at 02:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle’s security alert for an available patch or update to Oracle Advanced Pricing 12.2.3–12.2.15.
  • Restrict HTTP access to the Advanced Pricing component by allowing only trusted IP ranges or placing it behind a VPN or firewall.
  • Enable auditing and monitor logs for anomalous requests to detect attempted exploitation early.

Generated by OpenCVE AI on August 4, 2026 at 02:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Allows Remote Takeover of Oracle Advanced Pricing

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Allows Remote Takeover of Oracle Advanced Pricing
Weaknesses CWE-284

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle Advanced Pricing via Low‑Privilege HTTP Exploit
Weaknesses CWE-269
CWE-284

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle Advanced Pricing via Low‑Privilege HTTP Exploit
Weaknesses CWE-269
CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Pricing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle advanced Pricing
CPEs cpe:2.3:a:oracle:advanced_pricing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle advanced Pricing
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Advanced Pricing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-29T03:55:42.189Z

Reserved: 2026-07-08T15:51:55.597Z

Link: CVE-2026-60863

cve-icon Vulnrichment

Updated: 2026-07-24T17:53:52.255Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:23.440

Modified: 2026-07-29T05:16:55.233

Link: CVE-2026-60863

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:45:02Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function