Description
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Pricing accessible data as well as unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Advanced Pricing is vulnerable to a network‑based flaw that permits an attacker with low network privileges to alter, delete, or create critical data records. The impact is severe, involving both confidentiality and integrity violations, as attackers can read or tamper with any data exposed by Oracle Advanced Pricing. The weakness stems from insufficient authorization checks, allowing unauthorized manipulation of the application state.

Affected Systems

The affected product is Oracle Advanced Pricing within Oracle E‑Business Suite. Supported versions 12.2.3 through 12.2.15 are impacted.

Risk and Exploitability

The CVSS base score of 8.1 classifies this vulnerability as high severity, and the EPSS score indicates a very low probability of exploitation today, yet the flaw remains exploitable over HTTP without additional authentication. Although not listed in the CISA KEV catalog, the combination of network access and privileged actions requires immediate attention. Successful exploitation would provide attackers with unrestricted modification rights over all data accessible by Oracle Advanced Pricing.

Generated by OpenCVE AI on August 4, 2026 at 02:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch that addresses the authorization flaw for Oracle Advanced Pricing
  • Limit network exposure by restricting HTTP access to the Oracle Advanced Pricing service to trusted hosts only
  • Review and tighten database access controls and audit logs to detect unauthorized modifications

Generated by OpenCVE AI on August 4, 2026 at 02:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Unrestricted Access via Oracle Advanced Pricing Vulnerability

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Unrestricted Access via Oracle Advanced Pricing Vulnerability
Weaknesses CWE-284

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Advanced Pricing via HTTP
Weaknesses CWE-284
CWE-285

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Advanced Pricing via HTTP
Weaknesses CWE-284
CWE-285

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Pricing Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Pricing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Pricing accessible data as well as unauthorized access to critical data or complete access to all Oracle Advanced Pricing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle advanced Pricing
CPEs cpe:2.3:a:oracle:advanced_pricing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle advanced Pricing
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Advanced Pricing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-29T03:55:44.551Z

Reserved: 2026-07-08T15:51:55.597Z

Link: CVE-2026-60867

cve-icon Vulnrichment

Updated: 2026-07-24T17:46:51.787Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:23.677

Modified: 2026-07-29T05:16:55.660

Link: CVE-2026-60867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:45:02Z

Weaknesses