CVE-2026-60867: Oracle Advanced Pricing Escalation Flaw

CVE-2026-60867 Overview

CVE-2026-60867 affects the Oracle Advanced Pricing product within Oracle E-Business Suite, specifically the Pricing Installation component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Advanced Pricing. Successful exploitation results in unauthorized read, creation, deletion, or modification access to all Oracle Advanced Pricing accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can read, modify, or delete all data accessible to Oracle Advanced Pricing over HTTP with low attack complexity.

Affected Products

Oracle E-Business Suite — Oracle Advanced Pricing 12.2.3
Oracle E-Business Suite — Oracle Advanced Pricing 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Advanced Pricing 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60867 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-60867

Vulnerability Analysis

The vulnerability resides in the Pricing Installation component of Oracle Advanced Pricing. An attacker authenticated with low privileges can send crafted HTTP requests to the affected endpoints and gain unauthorized access to data managed by Oracle Advanced Pricing. The impact spans confidentiality and integrity, but not availability. Oracle classifies exploitation as easily achievable, meaning no special conditions are required beyond network reachability and a valid low-privileged session.

Because Oracle Advanced Pricing manages pricing rules, discount structures, and promotional data across E-Business Suite deployments, successful exploitation can distort commercial transactions, expose sensitive pricing logic, or corrupt financial data flowing through downstream modules such as Order Management and Receivables.

Root Cause

Oracle has not published detailed root cause information. Based on the CVSS profile (network vector, low privileges required, no user interaction, high confidentiality and integrity impact, unchanged scope), the flaw is consistent with a broken access control or authorization weakness in the Pricing Installation component. The affected code path fails to properly restrict data access based on the authenticated user's privilege level.

Attack Vector

An attacker requires network reachability to the Oracle E-Business Suite HTTP interface and a low-privileged authenticated account. Anonymous exploitation is not possible. The attacker submits crafted HTTP requests to Pricing Installation endpoints to read or manipulate Advanced Pricing data outside the intended authorization boundary.

No public proof-of-concept exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.365% at the 29th percentile as of 2026-07-23.

No verified exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60867

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Advanced Pricing endpoints originating from low-privileged user sessions.
Anomalous read, insert, update, or delete operations against QP_* pricing tables outside of normal business hours or workflows.
Application audit records showing pricing rule or qualifier modifications not tied to approved change tickets.
Session activity from accounts accessing Pricing Installation URLs they have never previously used.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Advanced Pricing responsibility.
Correlate application server access logs with database audit logs to identify authorized users performing out-of-scope pricing data operations.
Baseline normal Advanced Pricing HTTP endpoint usage per user role and alert on deviations.
Deploy web application firewall rules to flag high-volume or malformed requests against Pricing Installation URLs.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and HTTP server logs to a centralized SIEM for cross-source correlation.
Monitor privileged and low-privileged account behavior for lateral movement toward pricing modules.
Alert on modifications to price lists, modifiers, and qualifiers performed by service or generic accounts.

How to Mitigate CVE-2026-60867

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory internet-exposed Oracle E-Business Suite instances and prioritize them for patching first.
Rotate credentials for low-privileged accounts that could be abused to reach Pricing Installation endpoints.
Review Advanced Pricing audit trails for signs of unauthorized data access or modification since the affected versions were deployed.

Patch Information

Oracle released fixes for CVE-2026-60867 as part of the July 2026 Critical Patch Update. Customers on Oracle E-Business Suite 12.2.3 through 12.2.15 must apply the corresponding Advanced Pricing patch bundle documented in the Oracle Security Alert July 2026. Oracle recommends remaining on actively supported releases and applying all prerequisite technology stack patches.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted corporate networks and VPN ranges until patches are applied.
Remove Advanced Pricing responsibilities from user accounts that do not require them, reducing the pool of accounts capable of exploitation.
Enforce strong authentication and session controls on all E-Business Suite user accounts, including MFA where supported.
Enable Oracle E-Business Suite auditing for the Advanced Pricing module to increase visibility while patching is scheduled.

bash

# Example: restrict inbound HTTP access to EBS to trusted subnets using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Example: query FND_USER for accounts holding the Advanced Pricing responsibility
# (run as APPS in SQL*Plus)
SELECT u.user_name, r.responsibility_name
  FROM fnd_user u,
       fnd_user_resp_groups g,
       fnd_responsibility_tl r
 WHERE u.user_id = g.user_id
   AND g.responsibility_id = r.responsibility_id
   AND r.responsibility_name LIKE '%Pricing%';