CVE-2026-60521 Overview
CVE-2026-60521 affects the Oracle Advanced Pricing product within Oracle E-Business Suite, specifically the Price List component. The flaw impacts supported versions 12.2.3 through 12.2.15. An unauthenticated remote attacker with network access via HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized update, insert, or delete access to a subset of Oracle Advanced Pricing data, along with unauthorized read access to a portion of that data.
Critical Impact
Unauthenticated network attackers can modify and read pricing data in Oracle Advanced Pricing, threatening the integrity of pricing records used across the E-Business Suite.
Affected Products
- Oracle E-Business Suite — Oracle Advanced Pricing 12.2.3
- Oracle E-Business Suite — Oracle Advanced Pricing versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Advanced Pricing 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60521 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle addresses issue in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60521
Vulnerability Analysis
The vulnerability resides in the Price List component of Oracle Advanced Pricing, a module of Oracle E-Business Suite responsible for managing pricing rules, modifiers, and qualifier structures. An attacker reaches the vulnerable code path over HTTP without authenticating and without user interaction. The flaw exposes both integrity and confidentiality of pricing data. Attackers can insert, update, or delete records that Oracle Advanced Pricing exposes, and they can read a subset of accessible data. Availability is not affected, which suggests the issue lies in request handling logic that manipulates pricing objects rather than a service-disrupting defect.
Root Cause
Oracle has not published the underlying software defect classification for CVE-2026-60521. Based on the disclosed impact profile, the root cause is consistent with a broken access control weakness in a Price List endpoint that fails to enforce authentication or authorization before performing data operations. No CWE has been assigned in the NVD entry.
Attack Vector
The attack originates over the network and targets an HTTP-facing interface of Oracle Advanced Pricing. The attacker does not need credentials, session context, or victim interaction. Because Oracle E-Business Suite deployments are frequently exposed to internal networks and, in some cases, to the internet through reverse proxies, the reachability of the affected component determines exposure. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-60521
Indicators of Compromise
- Unexpected create, update, or delete events in Oracle Advanced Pricing tables tied to price lists, modifiers, or qualifiers without a corresponding authenticated user session.
- HTTP requests to Oracle E-Business Suite Advanced Pricing endpoints originating from unauthenticated sessions or unusual source IP ranges.
- Database audit records showing pricing changes outside standard business change windows or approved batch jobs.
Detection Strategies
- Enable Oracle E-Business Suite auditing on Advanced Pricing tables such as QP_LIST_HEADERS_B, QP_LIST_LINES, and related pricing entities to track row-level modifications.
- Deploy WAF or reverse-proxy rules that log and alert on anonymous access attempts to Advanced Pricing URLs.
- Correlate HTTP access logs with Oracle application session logs to identify pricing changes that lack an authenticated principal.
Monitoring Recommendations
- Continuously monitor middle-tier HTTP request patterns for anomalous POST or PUT traffic to Advanced Pricing servlets.
- Alert on high-volume pricing record changes from a single source IP over short intervals.
- Track patch state of all Oracle E-Business Suite 12.2.x environments to confirm the July 2026 CPU has been applied.
How to Mitigate CVE-2026-60521
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Oracle Advanced Pricing.
- Restrict network reachability of Oracle E-Business Suite middle-tier servers so that Advanced Pricing endpoints are not exposed to untrusted networks.
- Review recent pricing data changes for unauthorized modifications and reconcile against approved change records.
Patch Information
Oracle addressed CVE-2026-60521 in the July 2026 Critical Patch Update. Administrators should follow the guidance published in the Oracle Critical Patch Update Advisory - July 2026 and apply the patch bundle appropriate for the deployed 12.2 release. Test the patch in a non-production environment before rolling it into production instances.
Workarounds
- Place Oracle E-Business Suite behind an authenticating reverse proxy or VPN so that Advanced Pricing HTTP endpoints are not reachable by unauthenticated clients.
- Use Oracle URL firewall configurations in the E-Business Suite technology stack to block direct access to non-essential Advanced Pricing servlets until the patch is applied.
- Increase database auditing on pricing tables to detect exploitation attempts while remediation is in progress.
# Configuration example
# Refer to the Oracle Critical Patch Update Advisory - July 2026
# for the exact patch identifiers applicable to your EBS 12.2.x release.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
