CVE-2026-60714: Oracle Price Protection Auth Bypass Flaw

CVE-2026-60714 Overview

CVE-2026-60714 is a high-severity vulnerability in the Oracle Price Protection product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Price Protection. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Price Protection accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker on the network can read, modify, or delete all data accessible to Oracle Price Protection over HTTP with low attack complexity.

Affected Products

Oracle E-Business Suite — Oracle Price Protection versions 12.2.3 through 12.2.15
Internal Operations component of Oracle Price Protection
Deployments exposing Oracle E-Business Suite over HTTP to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60714 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update (Oracle Security Alert)

Technical Details for CVE-2026-60714

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Price Protection, part of the Oracle E-Business Suite. Oracle characterizes the flaw as easily exploitable over HTTP by an attacker who holds low-level privileges within the application. No user interaction is required, and the attack does not cross a security boundary between components.

Exploitation yields high impact on confidentiality and integrity. Attackers can read all data that Price Protection can access and can create, modify, or delete records in that same scope. Availability is not directly affected, so the vulnerability lends itself to stealthy data tampering and exfiltration rather than service disruption.

Because Oracle Price Protection manages pricing agreements and rebate calculations, unauthorized modification of records has direct financial consequences. Data integrity loss in this module can propagate to downstream ERP processes, including accounts payable and receivables reconciliation.

Root Cause

Oracle has not released detailed root-cause information beyond the advisory. The advisory indicates that a low-privileged authenticated session over HTTP is sufficient to reach vulnerable functionality in the Internal Operations component. This pattern is consistent with insufficient authorization checks on server-side operations exposed to authenticated users.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires valid, low-privileged credentials for the Oracle E-Business Suite instance. Once authenticated, the attacker sends crafted HTTP requests to the Internal Operations endpoints of Oracle Price Protection to read or manipulate data outside the intended authorization boundary. See the Oracle July 2026 Critical Patch Update for advisory details.

Detection Methods for CVE-2026-60714

Indicators of Compromise

Unexpected HTTP requests from low-privileged application accounts to Oracle Price Protection Internal Operations endpoints.
Unexplained creation, modification, or deletion of pricing, rebate, or price protection claim records in AP_* and OZF_* tables.
Anomalous session activity where standard users access administrative or cross-tenant Price Protection data.
Spikes in HTTP request volume to /OA_HTML/ endpoints associated with Price Protection modules.

Detection Strategies

Enable and review Oracle E-Business Suite audit logging (FND_LOGIN_AUDIT, page access tracking) for Price Protection activity by non-administrative users.
Correlate database-level audit trails on Price Protection tables against expected user roles and responsibilities.
Deploy web application firewall rules to flag HTTP requests to Internal Operations endpoints originating from user accounts without the corresponding responsibility.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized analytics platform for correlation.
Alert on any DML activity against Price Protection tables performed outside scheduled batch windows.
Track failed and unusual authentication events against E-Business Suite user accounts, especially service or low-privilege accounts.

How to Mitigate CVE-2026-60714

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 instances.
Inventory all Oracle Price Protection deployments and confirm patch status before returning them to production traffic.
Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted internal networks and VPN users only.
Review and reduce user privileges within Oracle Price Protection, removing responsibilities that are not required for business function.

Patch Information

Oracle released a fix in the July 2026 Critical Patch Update. Administrators should apply the patch bundle referenced in the Oracle Security Alert for CPU July 2026 to Oracle E-Business Suite versions 12.2.3 through 12.2.15. Follow Oracle's documented pre-install, install, and post-install steps to preserve customizations.

Workarounds

No official workaround has been published by Oracle; patching is the recommended remediation.
As a compensating control, restrict HTTP access to Internal Operations endpoints via reverse proxy or WAF rules until patches are applied.
Temporarily revoke Price Protection responsibilities from accounts that do not require them.
Increase audit granularity on Price Protection tables to shorten time-to-detect any exploitation attempt.

bash

# Verify installed Oracle E-Business Suite patch level after applying CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF