CVE-2026-60835: Oracle Price Protection Info Disclosure

CVE-2026-60835 Overview

CVE-2026-60835 is an information disclosure vulnerability in the Oracle Price Protection product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness to gain unauthorized access to data managed by Oracle Price Protection.

Oracle disclosed the issue in the Oracle Security Alert - July 2026. The vulnerability impacts confidentiality only, with no direct effect on integrity or availability of the target system.

Critical Impact
Successful exploitation allows an authenticated attacker to read all data accessible to Oracle Price Protection, including pricing agreements and internal operations records.

Affected Products

Oracle E-Business Suite — Oracle Price Protection 12.2.3
Oracle E-Business Suite — Oracle Price Protection versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Price Protection 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60835 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60835

Vulnerability Analysis

CVE-2026-60835 is an information disclosure vulnerability in the Internal Operations component of Oracle Price Protection. The flaw is remotely reachable over HTTP and requires only a low-privileged Oracle E-Business Suite account. No user interaction is required, and the attack complexity is low.

Successful exploitation exposes data accessible to the Oracle Price Protection module. This includes price protection agreements, claims, and related transactional records that support internal operations workflows. Integrity and availability of the application remain unaffected.

Root Cause

Oracle has not published root cause details beyond the advisory. The Critical Patch Update text indicates that an authenticated user can reach an internal operations code path that returns data without enforcing sufficient authorization checks. The result is horizontal or vertical access to records the caller should not be permitted to read.

Attack Vector

An attacker authenticates to Oracle E-Business Suite with any low-privileged account. The attacker then sends crafted HTTP requests to the Oracle Price Protection Internal Operations endpoints exposed by the application server. Because authorization enforcement is insufficient, the server returns records outside the caller's normal scope, resulting in unauthorized data disclosure.

No verified public proof-of-concept is available. Refer to the Oracle Security Alert - July 2026 for technical guidance from the vendor.

Detection Methods for CVE-2026-60835

Indicators of Compromise

Unexpected authenticated HTTP requests to Oracle Price Protection URLs under the Internal Operations component from accounts that do not normally use pricing functionality.
High volumes of successful HTTP 200 responses returning large result sets from Price Protection endpoints to a single session.
Access to Price Protection data from users whose responsibility set does not include pricing or claims administration.

Detection Strategies

Review Oracle E-Business Suite sign-on and function security audit logs for low-privileged users invoking Price Protection functions outside their assigned responsibilities.
Correlate application server access logs with database audit trails on OZF and QP schema tables to identify anomalous read activity.
Baseline expected user-to-function mappings and alert on deviations that touch Internal Operations pages.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit at the FORM level for all Price Protection responsibilities.
Forward Oracle HTTP Server and WebLogic access logs to a centralized log platform for retention and query.
Alert on sustained access patterns to Price Protection URLs from non-pricing user roles.

How to Mitigate CVE-2026-60835

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite environments, including non-production, and confirm patch status for each.
Review Price Protection responsibility assignments and revoke access from users who do not require it.

Patch Information

Oracle addressed CVE-2026-60835 in the July 2026 Critical Patch Update. Administrators should download and apply the fix documented in the Oracle Security Alert - July 2026. Oracle recommends applying Critical Patch Update fixes without delay and only supports patched configurations for further security response.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so that only trusted internal networks can reach the application tier.
Disable or restrict Oracle Price Protection responsibilities for users who do not need access to the module until the patch is applied.
Enforce strong authentication and session controls to reduce the pool of low-privileged accounts an attacker could abuse.

bash

# Example: list users with Price Protection responsibilities in Oracle EBS
sqlplus apps/<password> <<EOF
SELECT fu.user_name, frt.responsibility_name
FROM   fnd_user fu,
       fnd_user_resp_groups_direct furg,
       fnd_responsibility_tl frt
WHERE  fu.user_id = furg.user_id
AND    furg.responsibility_id = frt.responsibility_id
AND    frt.responsibility_name LIKE '%Price Protection%'
AND    furg.end_date IS NULL;
EOF