CVE-2026-60838: Oracle Price Protection Auth Bypass Flaw

CVE-2026-60838 Overview

CVE-2026-60838 is a high-severity vulnerability in the Oracle Price Protection product of Oracle E-Business Suite, specifically in the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Price Protection. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to a subset of Oracle Price Protection accessible data. Oracle disclosed the issue in the Oracle Critical Patch Update Advisory for July 2026.

Critical Impact
An authenticated network attacker can modify or delete critical Oracle Price Protection data and read a subset of accessible data through HTTP requests, without user interaction.

Affected Products

Oracle E-Business Suite - Oracle Price Protection versions 12.2.3 through 12.2.15
Internal Operations component of Oracle Price Protection
Deployments exposing Oracle E-Business Suite HTTP endpoints to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60838 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory for July 2026

Technical Details for CVE-2026-60838

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Price Protection, an Oracle E-Business Suite module used to manage supplier pricing agreements and claims. An attacker holding low-privilege credentials can send crafted HTTP requests to reach functionality that fails to enforce proper authorization or input controls. The result is broken access control that permits data tampering across records accessible to Oracle Price Protection.

The impact profile emphasizes integrity over confidentiality. Attackers can create, modify, or delete price protection records and related business data, while confidentiality exposure is limited to a subset of accessible data. Availability is not directly affected, but integrity loss in pricing and claims processes can produce downstream financial and operational consequences.

Root Cause

Oracle has not published detailed technical root-cause information. Based on the vector and impact description, the flaw is consistent with a broken access control or improper authorization weakness in an HTTP-exposed servlet or business function within the Internal Operations component. Authenticated users appear able to invoke privileged operations outside their intended role scope.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. The attack complexity is low and no user interaction is needed. An attacker sends targeted HTTP requests to the vulnerable Price Protection endpoints, invoking data-modifying operations that should be restricted. In multi-tenant or supplier-facing E-Business Suite deployments, the exposure is broader because more accounts can reach the interface.

Oracle has not documented public proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle CPU July 2026 Advisory for vendor guidance.

Detection Methods for CVE-2026-60838

Indicators of Compromise

Unexpected create, update, or delete operations on Oracle Price Protection tables performed by low-privileged accounts
HTTP requests to Oracle E-Business Suite Price Protection Internal Operations endpoints originating from unusual source IPs or user agents
Application audit log entries showing role-inconsistent access to Price Protection functions
Anomalous spikes in Price Protection transactions outside business hours

Detection Strategies

Enable and centralize Oracle E-Business Suite Sign-On Audit and page access tracking for Price Protection functions
Correlate database-level audit records (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) with HTTP access logs to identify privilege-inconsistent activity
Baseline normal Price Protection user behavior and alert on deviations in transaction volume or record modification patterns
Ingest Oracle EBS application and web tier logs into a SIEM for cross-source correlation and long-term retention

Monitoring Recommendations

Monitor Oracle HTTP Server access logs for repeated POST requests to Price Protection URIs by the same authenticated session
Track modifications to critical Price Protection tables and flag activity from responsibilities not authorized for such changes
Alert on new or rarely used user accounts accessing Internal Operations functions
Review outbound network traffic from EBS mid-tier hosts for signs of data exfiltration following anomalous access

How to Mitigate CVE-2026-60838

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all affected 12.2.3-12.2.15 environments
Inventory all Oracle E-Business Suite instances and confirm patch status for the Price Protection module
Review and restrict responsibilities that grant access to Oracle Price Protection Internal Operations functions
Rotate credentials for low-privileged accounts if suspicious Price Protection activity is identified

Patch Information

Oracle addressed CVE-2026-60838 in the July 2026 Critical Patch Update. Administrators should follow the patch application steps in the Oracle CPU July 2026 Advisory and validate the patch in a non-production environment before promoting to production. The advisory contains the specific patch identifiers for supported E-Business Suite 12.2.x releases.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewall rules and reverse proxy access controls
Remove Price Protection responsibilities from users who do not require them until patching is complete
Enforce strong authentication and session controls on all EBS user accounts to reduce the pool of usable low-privilege credentials
Increase audit logging verbosity for Price Protection functions during the remediation window

bash

# Example: check applied patches on Oracle E-Business Suite 12.2
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_PATCH_ID>')
 ORDER BY last_update_date DESC;
EOF