CVE-2026-60863: Oracle Advanced Pricing Escalation Flaw

CVE-2026-60863 Overview

CVE-2026-60863 is a high-severity vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite, specifically within the Pricing Installation component. Affected releases span versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw to fully compromise Oracle Advanced Pricing. Successful exploitation results in complete takeover of the application, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
An authenticated attacker with minimal privileges can remotely take over Oracle Advanced Pricing across all supported 12.2.x releases via HTTP, gaining full access to pricing data and application logic.

Affected Products

Oracle E-Business Suite - Oracle Advanced Pricing 12.2.3 through 12.2.15
Pricing Installation component
Deployments exposing Oracle Advanced Pricing HTTP endpoints to internal or external networks

Discovery Timeline

2026-07-21 - CVE CVE-2026-60863 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the July 2026 Critical Patch Update

Technical Details for CVE-2026-60863

Vulnerability Analysis

CVE-2026-60863 affects the Pricing Installation component of Oracle Advanced Pricing within Oracle E-Business Suite. The vulnerability is exploitable over the network via HTTP with low attack complexity. Oracle classifies the flaw as easily exploitable, requiring only a low-privileged account and no user interaction. Successful exploitation results in a full takeover of Oracle Advanced Pricing, exposing pricing rules, qualifiers, modifiers, and downstream order and quoting workflows. The Exploit Prediction Scoring System (EPSS) currently places this CVE at the 38th percentile, indicating moderate near-term exploitation likelihood despite the high impact profile.

Root Cause

Oracle has not published the underlying technical root cause. Based on Oracle's advisory metadata, the flaw resides in the Pricing Installation component and permits an authenticated user to escalate access and compromise the entire Advanced Pricing module. The class of issue is consistent with insufficient authorization enforcement or input validation on privileged HTTP-exposed functionality. Consult the Oracle Security Alert July 2026 for vendor-provided details.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite web tier. An attacker requires a valid low-privilege session on the affected application. From that position, the attacker sends crafted HTTP requests to Advanced Pricing endpoints tied to the Pricing Installation component. No user interaction is required, and the scope remains unchanged. The outcome is full compromise of Oracle Advanced Pricing, with high impact to confidentiality, integrity, and availability.

No verified public proof-of-concept code is available at the time of publication. Refer to Oracle's advisory for technical remediation details rather than relying on unverified exploit artifacts.

Detection Methods for CVE-2026-60863

Indicators of Compromise

Unexpected HTTP POST or GET requests to Oracle Advanced Pricing servlet paths originating from low-privileged user sessions.
Modifications to pricing rules, modifiers, qualifiers, or price lists made outside of standard change windows.
Creation of new privileged responsibilities or menu entries within Oracle E-Business Suite by non-administrative accounts.
Unusual outbound connections from the E-Business Suite application tier following Advanced Pricing activity.

Detection Strategies

Review Oracle E-Business Suite access logs and Apache/OHS access logs for anomalous request patterns against Advanced Pricing URLs.
Correlate FND_LOGIN and FND_UNSUCCESSFUL_LOGIN records with Advanced Pricing configuration changes in QP_% tables.
Baseline normal pricing-workflow HTTP traffic and alert on deviations in URI patterns, request volume, or parameter fuzzing.
Enable database auditing on Advanced Pricing schema (QP) objects to capture unauthorized DML or DDL activity.

Monitoring Recommendations

Ingest E-Business Suite application, middle-tier, and database audit logs into a centralized SIEM for cross-source correlation.
Alert on privilege changes to Advanced Pricing responsibilities and on off-hours access from service or low-tier accounts.
Monitor for lateral movement from the E-Business Suite application server to internal database and identity systems.

How to Mitigate CVE-2026-60863

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running Advanced Pricing versions 12.2.3 through 12.2.15.
Inventory all E-Business Suite environments, including non-production, and confirm patch coverage across the Pricing Installation component.
Restrict network exposure of the E-Business Suite web tier to trusted networks and VPN users only.
Review and reduce user responsibilities that grant access to Advanced Pricing functions, applying least privilege.

Patch Information

Oracle addressed CVE-2026-60863 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding patch set for their Oracle E-Business Suite 12.2 release. Test the patch in a staging environment prior to production rollout, and validate custom Advanced Pricing extensions after patching.

Workarounds

Place the Oracle E-Business Suite web tier behind a web application firewall with rules limiting access to Advanced Pricing servlets to known administrative source addresses.
Disable or restrict Advanced Pricing HTTP endpoints that are not required for business operations until patching is complete.
Enforce multi-factor authentication for all E-Business Suite users to raise the cost of the low-privilege access precondition.
Rotate credentials and review session activity for any low-privilege accounts that had access to Advanced Pricing prior to patching.

bash

# Configuration example: restrict Advanced Pricing URLs at the reverse proxy
# (Apache HTTP Server / Oracle HTTP Server)
<Location /OA_HTML/OA.jsp>
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>

<LocationMatch "^/OA_HTML/.*(Pricing|QP).*">
    Require ip 10.10.20.0/24
    Require valid-user
</LocationMatch>