Description
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in Oracle Price Protection, identified as an access control failure (CWE-284), allows an attacker with low privileges who can reach the system over HTTP to create, delete, or modify critical data. The vulnerability also grants read access to all data managed integrity of information handled, with a CVSS 3.1 base score of 8.1.

Affected Systems

Oracle Corporation's Oracle Price Protection component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15, are affected. No other vendors or products are identified as vulnerable.

Risk and Exploitability

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N shows a high severity remote vulnerability that requires low privilege and no user interaction. The EPSS score is under 1%, and the issue is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed. The likely attack path proceeds over HTTP from a network-accessible host, exploiting the missing or insufficient access controls within the product.

Generated by OpenCVE AI on August 4, 2026 at 00:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest patch or upgrade to a non-affected version of Oracle Price Protection
  • Restrict HTTP access to the Oracle Price Protection instance to trusted hosts or networks, using firewall or VLAN segmentation
  • Enable detailed logging and audit trail for data modification actions, and regularly review logs for unauthorized changes

Generated by OpenCVE AI on August 4, 2026 at 00:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Oracle Price Protection Access Control Failure Allowing Low-Privilege Data Modification

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Oracle Price Protection Access Control Failure Allowing Low-Privilege Data Modification

Mon, 27 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability in Oracle Price Protection Enabling Unauthorized Data Modification

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability in Oracle Price Protection Enabling Unauthorized Data Modification

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Price Protection accessible data as well as unauthorized access to critical data or complete access to all Oracle Price Protection accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle price Protection
CPEs cpe:2.3:a:oracle:price_protection:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle price Protection
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Price Protection
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T17:44:30.252Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61329

cve-icon Vulnrichment

Updated: 2026-07-22T17:44:07.900Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses